Resubmissions
28-05-2021 05:59
210528-mj2qwc9z3x 1019-05-2021 14:41
210519-khtrssqv6a 1010-05-2021 18:06
210510-ncy7w9kqte 10Analysis
-
max time kernel
600s -
max time network
598s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-05-2021 14:41
General
-
Target
93394d6e_by_Libranalysis.dll
-
Size
588KB
-
MD5
93394d6e0ea894922267955095fabbc9
-
SHA1
38ac582b64fb09f212aceddf5e3cc13946c69985
-
SHA256
7f0f199833687549249b22ec50bbcb234d2ad2b8da993a6cbc86db8a53236530
-
SHA512
aceecbcccd6fe48586d695b0ef04d7d0b998069dbb6545dc9ca96045f896281663027cf048ce2d0f27d0e2990f03c1f592322bfa9bc9776f153d07c6993cc8e7
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Loader 2 IoCs
Detects Dridex both x86 and x64 loader in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 26 IoCs
-
Suspicious use of FindShellTrayWindow 10 IoCs
-
Suspicious use of SendNotifyMessage 18 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\93394d6e_by_Libranalysis.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\mlbHTZS\DeviceEnroller.exeC:\Users\Admin\AppData\Local\mlbHTZS\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\VW8ILl\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\VW8ILl\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\EZ1\Netplwiz.exeC:\Users\Admin\AppData\Local\EZ1\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
7d51a4ca88e2e7f4362716f0575eea6a
SHA1eea7840855e45340f1eaee7c018258c2bb675a45
SHA25676289b13bf66d7cd221dc52def5e22d014a1795c79726c1228cc6c659a810a2e
SHA512220790f0d1c3d07aeb264143b12a1d83fc96041cb533e761180751d5415908a90014b51f891dbd8585b11bd0e3b19782e60e43135024e4c3aa02bbf8f19cd554
-
MD5
a5acd80ecb8474371df9ea90c2276572
SHA1a0fe5331bcb81aef9b0e0839ba0a71c2dcd78a08
SHA256211ffe401b62de5ece1b863f3ba1c30279bd4b6a294141c80687005227c09388
SHA5125e75bef5d25195ebf388ad771d713f80b2147348fc617677a9db9f3d94b65b25da332ef25b6790ac74349aeaefc2a18ae3b9573097f098313d0533f6e7ca9165
-
MD5
583914a93db0413668eadd743fd5fb1c
SHA18b95be0ad348f0aabfcceac3148109ef12e8a978
SHA256ec09ee1b2bb981335ea9db3ac031fbbc3ed74f9294d734a5799fb0d75e423583
SHA5122f5c22cc3f557c65c876e8a943c7b3dec92d5c0b5219ab2410a334f42e442ef08d0c7b1c5c0797b83a17578a25ce70aa631a15be7ec6a6ea8a8d865dca0b9cd4
-
MD5
38476b039febb0ae8dba6057456874e7
SHA1eecbe7be8c814934f7b41fa6b9bf13dbd3f77f96
SHA2561cdc48c2f9a04edb7635e37f488ff3c318c3e18ea3ed9bbb3dad1a6092cd5386
SHA512368615d8767372cd99aea4ad7825fea8bbb8b018de2838e57e21183898f390aaa17c9fc99277c91f1863457e8c8cf503da885767a1c8de683c449147cfd201e9
-
MD5
bd732a3a065f5cca6df003a7ca78bb35
SHA1449d027d933fdd530a6a27d7c2132f98ee56374a
SHA256fd5f32939c8de2d80a6f2481268313b5151c21c474c61635c92d2b8ea436955e
SHA512d1cd727841522be31e979484cdea467501693e1a3bab2fabc72510c73698353c960f7d2c16be9a4406d804da2b2ad7da58827a630f9616ebe296cae481103701
-
MD5
c680d56cc2498c007ca161261f1d0537
SHA1e067761b8dba7e913bdfda1539d0dc4fcfa5793c
SHA256f6cd8c617302bd47d988f8a084afce454960a54b0058ecad3092bcb242b4ab3b
SHA5122ec6bdedf9cfc8eff85dbf6393ef6f33312e978e92a1bec2572ccd97135c479285cb189835fb754f91fd03b931fbd216d3f5e3915f5eb915190d4af8e6e84ec2
-
MD5
7d51a4ca88e2e7f4362716f0575eea6a
SHA1eea7840855e45340f1eaee7c018258c2bb675a45
SHA25676289b13bf66d7cd221dc52def5e22d014a1795c79726c1228cc6c659a810a2e
SHA512220790f0d1c3d07aeb264143b12a1d83fc96041cb533e761180751d5415908a90014b51f891dbd8585b11bd0e3b19782e60e43135024e4c3aa02bbf8f19cd554
-
MD5
38476b039febb0ae8dba6057456874e7
SHA1eecbe7be8c814934f7b41fa6b9bf13dbd3f77f96
SHA2561cdc48c2f9a04edb7635e37f488ff3c318c3e18ea3ed9bbb3dad1a6092cd5386
SHA512368615d8767372cd99aea4ad7825fea8bbb8b018de2838e57e21183898f390aaa17c9fc99277c91f1863457e8c8cf503da885767a1c8de683c449147cfd201e9
-
MD5
c680d56cc2498c007ca161261f1d0537
SHA1e067761b8dba7e913bdfda1539d0dc4fcfa5793c
SHA256f6cd8c617302bd47d988f8a084afce454960a54b0058ecad3092bcb242b4ab3b
SHA5122ec6bdedf9cfc8eff85dbf6393ef6f33312e978e92a1bec2572ccd97135c479285cb189835fb754f91fd03b931fbd216d3f5e3915f5eb915190d4af8e6e84ec2
-
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
632KB
-
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-