Resubmissions
Analysis
-
max time kernel
150s -
max time network
6s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
14-07-2020 11:19
General
-
Target
VERSION.dll
-
Size
972KB
-
MD5
07b6339df2acddd30de436999071fc4b
-
SHA1
2550d842be80b811afa930384c0db06908bc1011
-
SHA256
4ed7566f8b70e42f52615a3c06512b10c6b3feef33627a82cdef1f054aa4cc75
-
SHA512
ef2b54af64064f6fdd4224b3b283e9e6b76d8d92a01d6e9044d016bbf2b2b295f4ed66a48d389a08ed4fc3d72a843f7ed32f43f91280658f897b2ad078324586
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 1 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Dridex Loader 'dmod' strings 1 IoCs
Detects 'dmod' strings in Dridex loader.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 599 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of FindShellTrayWindow 7 IoCs
-
Suspicious use of SendNotifyMessage 33 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\VERSION.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\tnICCSYI\Utilman.exeC:\Users\Admin\AppData\Local\tnICCSYI\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\AtQK\PresentationSettings.exeC:\Users\Admin\AppData\Local\AtQK\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\8HgqZ5O\msinfo32.exeC:\Users\Admin\AppData\Local\8HgqZ5O\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
322adec77ecb08bb9e7fc4552301cfb1
SHA1c1b1c085fdcd3f6cf6e6800d9d235b9afccc51c7
SHA256a3d0cd3f3467825e730c7e3c46f25c4c093818b4a98245446658f326afd04edd
SHA5127f3c122749d9b550c0733e16291dae808d8d4fe2a199db4925fae1a3fe5804c045247e981cee20a6d637d23b724f05dbd831310b9aa33e815da58576413b6a2d
-
MD5
d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
MD5
a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
MD5
6b2655c7a6d2e1e09a05d60c62e67175
SHA16e8f9719a089c0994b5c9880c9ece19c11cfbfef
SHA256b725cb69f63d3f3f63ed9bd84ed39ec09e0a1a9561f6d507e2fded2fd12709e4
SHA512854d7878b1684da20bc96cced1669028902e92a01fc7917e0efec35e7284a3d565129dc3d13037028c6155aba5018b9f5e0b98236f91a6fbd93fdf2e2d9763a4
-
MD5
612ce0ed64f024e66171b8e65f61b99c
SHA11655922f39c8bd9d22e98619524b353ed8c41ad2
SHA256b2a16ca4eaf41a87e4f7312068a93814fa2611470aa433b19f33250827500f22
SHA5128581817bba753a4d392f37b431079b860c8dd5d6df47d3c48b1bdb9f789e4c35ee0887f0a4d42795025afcf55be1ed9876b756e928551a23549f0994e306e6f9
-
MD5
32c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
MD5
322adec77ecb08bb9e7fc4552301cfb1
SHA1c1b1c085fdcd3f6cf6e6800d9d235b9afccc51c7
SHA256a3d0cd3f3467825e730c7e3c46f25c4c093818b4a98245446658f326afd04edd
SHA5127f3c122749d9b550c0733e16291dae808d8d4fe2a199db4925fae1a3fe5804c045247e981cee20a6d637d23b724f05dbd831310b9aa33e815da58576413b6a2d
-
MD5
d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
MD5
a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
MD5
6b2655c7a6d2e1e09a05d60c62e67175
SHA16e8f9719a089c0994b5c9880c9ece19c11cfbfef
SHA256b725cb69f63d3f3f63ed9bd84ed39ec09e0a1a9561f6d507e2fded2fd12709e4
SHA512854d7878b1684da20bc96cced1669028902e92a01fc7917e0efec35e7284a3d565129dc3d13037028c6155aba5018b9f5e0b98236f91a6fbd93fdf2e2d9763a4
-
MD5
612ce0ed64f024e66171b8e65f61b99c
SHA11655922f39c8bd9d22e98619524b353ed8c41ad2
SHA256b2a16ca4eaf41a87e4f7312068a93814fa2611470aa433b19f33250827500f22
SHA5128581817bba753a4d392f37b431079b860c8dd5d6df47d3c48b1bdb9f789e4c35ee0887f0a4d42795025afcf55be1ed9876b756e928551a23549f0994e306e6f9
-
MD5
32c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
MD5
d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
-
Filesize
4KB
-
Filesize
972KB
-
Filesize
972KB
-
-