Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
19-12-2023 12:29
General
-
Target
227be832cb0331964c534ca62ff07fbb.dll
-
Size
852KB
-
MD5
227be832cb0331964c534ca62ff07fbb
-
SHA1
64993ccac4f2ca980439e9261ed720037f73b9ca
-
SHA256
ba5348b7c934cf0e0dfd3f74f8702703a52ef5235c6a1082dfc906a30d6fc89b
-
SHA512
3c26ed9d816e810c66af6fade10e3627d7114dad3e50ba02ef1242b8753497a43ba3eaa97b2da7425b22fa748ce7f959b3ef0bd76024dfd130c4cfc3faedfd19
-
SSDEEP
12288:mdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:AMIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 7 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\227be832cb0331964c534ca62ff07fbb.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\Xx20r\isoburn.exeC:\Users\Admin\AppData\Local\Xx20r\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\IM1Kr\p2phost.exeC:\Users\Admin\AppData\Local\IM1Kr\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\oKxm89\tabcal.exeC:\Users\Admin\AppData\Local\oKxm89\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
856KB
MD5ca9e584bf267cfd578c3ca69e11e42fa
SHA172741132021fc7ab5a5c1e9a991772b2e72b9b07
SHA256178fdcf0032a4b47d166696133caafc977b850707ab1624a0f2318f1b22dc85f
SHA512b463d8536714734415047629600dcc6ac384c78da6fb15be2d78d24c356d8104702194fe17bb0f3f9503a141e02906eb6f34e9196d552829e4baf6f180df4748
-
Filesize
856KB
MD536ef4fbd6515c5d7e030ec7c65c19544
SHA152f09946004576f3aa97fa864616bbe54cd7d337
SHA256a72350bf8b634bce354a8d4b5849acadd85982227301e20f6a48d10b5700de87
SHA512b5b0d4749060f1ac16b3dcde3635d187ef702646eb6721de1c8e0cec7fed3ba2c98b969caaaaea2e384d5416cd13c65ebe3248bcc83cddcc4b7d579ff6ab555f
-
Filesize
856KB
MD592c74d4f24c24c20736d29534eaf7142
SHA1651eae858b8cf70497b2a53a4ebc0fa9c97316db
SHA2562f87520096fa712c903b030b03eb0369031eaf1b3eba024208553ffcf3ce206a
SHA51254fbd59dd5fe0c0a823fd7709b46d4f9b11b0502325313eb26a5d7f25f6d240d9b8c0911bdfb0ccb88e41b293082490e57909fcecc87c97b6cde02517f4e6726
-
Filesize
1KB
MD5a636b684f617c9c9d3e98fb9bd11b256
SHA1d66b3b4d5c7202c7f73b68c89102fd1d94297b44
SHA256d91c77147b1b5c3df04580f51a03b2164a4a4ee60a155a0b911cd79c1ca8d460
SHA512f999354f8648de21040cc4e88f47e294be7c398966561d8fc4078fb5a29ba30831102ff4f167191f96201077fb6f45cb9e9b785aab5dcfbddd4887576bb52e2e
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
89KB
MD5f8051f06e1c4aa3f2efe4402af5919b1
SHA1bbcf3711501dfb22b04b1a6f356d95a6d5998790
SHA25650dcb4be409f50d26c0fc32dd9cdbf96bff4e19bf624221cb566ebeb3e09ce1a
SHA5125f664d937abe4426ee7e0d8491a395f9ef4ffe7a51dba05b54b7ba27e80c9be37833400911c5878d3dec659f4fa1579ec8ba4cfc485fb2ce24dd37c321006daa
-
Filesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
856KB
-
Filesize
28KB
-
Filesize
856KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
852KB