Analysis
-
max time kernel
161s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 14:16
General
-
Target
bcd53a03a12a4ce08e833fdcdd8d8cca.dll
-
Size
2.0MB
-
MD5
bcd53a03a12a4ce08e833fdcdd8d8cca
-
SHA1
0e84a0c65f7eb5273609ec94a4de8217995726db
-
SHA256
610801e1516dac10986662e4aa33209c5699069c84322ac8abdcd548a8eb3ea0
-
SHA512
729335e687444f306acea30cb14569247b3ffda79d935a08163a5d0fc92d2268fa0023249c10789833b4f2202e8c7832617256c9c362585a8bb4afaeee3c6788
-
SSDEEP
12288:lVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:8fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bcd53a03a12a4ce08e833fdcdd8d8cca.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\FWGw2\dwm.exeC:\Users\Admin\AppData\Local\FWGw2\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\YsHP\Taskmgr.exeC:\Users\Admin\AppData\Local\YsHP\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\Gzve\ie4uinit.exeC:\Users\Admin\AppData\Local\Gzve\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD53fdffa925a16479aea86338ed831e7a2
SHA19345cbc804d4c7164835e0ede7c3c5df53d03477
SHA256e2e46d1e73daad4b45550e28ddc0c56219a74eafefba732fc8253e5244c58695
SHA512bf9d43074bf1c0e05073885a3d0013cc2ef90ec919f429ab6d00cc657319f4b890bcbd2926432151b258884727adceb2a532b159733b37863befbd31cfe59c01
-
Filesize
25KB
MD58c73638431b6b772ee1be83951955fea
SHA1ae861d10a608fa93b0c1f2c37e78fb9cebf68158
SHA256f76b4b8d156c0a25c9440d3f23c7606228839acfc754710ad8ba4d319b09d62b
SHA5124d7eee6e421eeaf12e0d2a75be9787108eb1341e2186bbeafb8e4121756968080a5371ff6ec8f0c820d47ba0f497258873cbf4ddfd7714a204d1cadeed2c44cd
-
Filesize
75KB
MD5ddad595736f9eee6eba6eda0acf4a03e
SHA13a53326a536bf95a4a89d82a0d25df6ee73ca510
SHA25649ac2dbfe8262ec9b75ff052b9f4da64693ff4c8b8bc6d98ae48b004a5dc39a5
SHA512bae18289c21e1495fe04a7e5fb4e73ee84c83508340a2edacdb54e54098db50d7d7d70ec43ef49f0e54bb20c143a8f757d7cabce77817c15e97a449213b0ec9d
-
Filesize
120KB
MD53f00b6ecc118ea0064e25c6c726ad5c1
SHA1e7674f8aae9f61557acd8b5d5c40d519e4872f3c
SHA2566a3bffd4970ff615344ddc2c807b44b0b2c40dcca7775e058ae774af673f0383
SHA51217c44a4c255bd67cb972766373cb125bbb55e6e5947a621fa52b859d5055912d0a0a533d63350cc26766579f9232b09a78c8c58a8d9bf8076626150cb61d748d
-
Filesize
17KB
MD5487c1eabcab90766acf220a4ce9a616f
SHA170f2f24fa2193403621aae5cabe6af146002c026
SHA256d1d77ae960165bd23b3ee84acaf1cc48d4837bac4058d44db73bc80f8c0d8604
SHA512192224a14b530d615a80071a19a5f068f83af88c49f19ea8e17ac9331b35099c79346ae7b89d51012bbda75e77d538b494b8bb3986d23e56404e8071861ef0d6
-
Filesize
52KB
MD578b4b106a1d670e122a7134fc32a0609
SHA18ca1d7cdf3a51772369618080d5819d6c934d0b9
SHA2566f9a248cd4f0268414fc26e02dfeb79a9f459244c7c4bb6e7c3ea4200d595ea6
SHA5127c07b730e7bb0ac34700f4d71ed74f7dd78608b6dadb65a0d3f16eacfbacfd44d54d43a3cdb1b3065fbec9b768e6c561c3873e2233f7ab7c7b7334cf261dcc77
-
Filesize
92KB
MD5fb2edc56e60735d9a011aaa006d513cb
SHA18a8032ed3a2cfc4e8f651fc80980108d711a0045
SHA25697ee81b8dd5ae181b183383afb008cdb735992f3564d5431701261e14adfca90
SHA5125cd1452476b379c69d3c5b6b4d4a872e129aae7dd4b35db33bf843784f7ef7c44f719cfb7bc9d10eee57ab62680821092e36c425694d58b0574292c8ddbfa47f
-
Filesize
17KB
MD5a442db83b38d5ae37493d36aa7069625
SHA154d72f7ca5bd4a754eae9cdc2b03451b7834f1cb
SHA2564d150ff3c5a254b56165f497e4991c5db7b99e9a80b7447a3daa772df20df6b6
SHA5126278366f9c748f759bcf7035298b849830b791bc43dbe6e3181bebf700346b2e468d068568d7dcd5376296d49776468df483bc1bc55e0ebd534f3166dbc6aed2
-
Filesize
111KB
MD544bb1f3c9ec31f1c0ed5cfce30d5dd20
SHA16966a2ae66ed4da4d888a83860a5384d0336f74b
SHA256ba9ef5d52950212357fc43808ca38c2c04c33ee19ea386148e33eed8db285ee3
SHA512f456355d7c6d80a87ef6e1a7b7dd0cf07a9b9dae0be5c66763b1970ede50632a27b7123931753fe57b8ce8ea53ac3c91d771bb284169ea169181f1103abede69
-
Filesize
161KB
MD5ef96b65d31bb1612cfc022295e10f585
SHA1c2ca239225bda5a47bea4169e393afe0e646822c
SHA256895aa84b9fedcf467958c135f4ec9ff06441435a7363370febb24b9f5bd54c29
SHA512680ff76f774c7adaac328aaa9edf197f4732e5ccc656b5d31c1ed72a6dfa5434ba064b6ed5a4f6366dd60fcc533eaa0db870401140019f3c70384db3aa2b57cf
-
Filesize
310KB
MD5e3a0f3db72809acea5d0b5a3edec6c3b
SHA12b617025e89bd7a1d4555b934e28d7e58d79b450
SHA256e8c86837e98b0b723a54af5a36084b92339c53f50fa00e3a6ff582af7a13041b
SHA51219a5d024154f13538710917e378ef54a612a1adf2701e340ae6cccd922d964c763d75dbc9dde616afcb6fe17aafc08b2daf974b92e28efc19db29fefcae4b0e3
-
Filesize
192KB
MD58ea7ed71e80e47c22cf386a2cd786604
SHA1bc75dc82022df7da0e9e92fa058b05076c232779
SHA2560cf9f9cda93c01341e247f7d9209e984d66ebaebe13fcba9184a1431e7ec0eaf
SHA512642469274ce86038f405d3f956df77cbfd3ace68169d4ad5f825c873ccedf5b1377ea1183e186f39f07b39d65c5c698d80dd100a805b5d4d5483fc9601f99aa5
-
Filesize
82KB
MD57d8fc747dff44047037c95b274422f41
SHA1fee29768501b370bcc00acc759169b9d756f4c7a
SHA256a30f8745a121fb894737fe4ad89489b037c1d816f56bdf863c4b5c230f8e61ef
SHA512473ea5bbf4b097183e593a1fb7f127b9b32d3d2740ae6bb99bb3377648836cad6e27de06097d3d76c8a4521d2fc5914a2a196a545bfa71e61409f6a43fddbb35
-
Filesize
113KB
MD5ac1971245db9a27a20ffc7ae05a0bba9
SHA1884ed004ea78ee6400036a02de4313e9f77a5e45
SHA2562eeb2d4847f9a7c96519f00da9434bad505713402be86939b644ae3c89a039ec
SHA5125b20331102a0ed9f3585cf9ab99c83bb9b85e8deca5ad9d4fac33b7fa926eb0ca697e57d2005e6f6c71defd267699949fc39a40fa21c756035654bd661a74776
-
Filesize
72KB
MD56c650fde2b41884dfa1f6cd54cda01a4
SHA14a2502b002d9cb9f28e40399224ba54b130af177
SHA256974507d9549b88a9f6f524e99a72069ecca5478a83679b7e733f5558c3416e91
SHA5124d1d77bc97c2efaa40e4dcac367be32a3be889abda9542d4b65b2b1a58b4cc4767471209566f4803d8b141f5a70d4ab7b867367c00d29f28a29d6d65affbca1e
-
Filesize
109KB
MD5b778960b978a8345cc395bc829cb9c67
SHA1cc636e7031343ee8a0a9adcbd59827f68da3c046
SHA2561d96b13d1ffdfd0a22b11185c744be6b9980dc39d3abaa2bc37275886ea92ff8
SHA5123bfdb51293d315ecddeb993ab244f4c8a61ae1f3bcc244afdac02dd429521bc486bbec7e258348915bb0dbd0d1314c2d3d3676dd48a27d922f77c40fa66f54e6
-
Filesize
190KB
MD521d888a90a4d7f2bea24d04f36bd0361
SHA1da84783ce80c0e035263b1df47d84b64d7e0736c
SHA256ce24e670c932850b25a491a38d9708d01bb4eaace387f01c4db976d9a23326b6
SHA512766e89d58511ba2ef2e7bd6564a27155133a994e7ac1103e9acabe40fa1e861d4e82af77d94a87885a5b1d75af6cf14359329d1de7a1c144c596c394a8ac8d19
-
Filesize
1KB
MD52055dee89ec48dff1ce01c6323abe100
SHA1fa6b6eba198382bb01cb1acaebc663315b47bf20
SHA256dc851629fbaf623b939e93fd5fa82a283ce6b98b2a09d6cf735083283ca3b85e
SHA51292dd8832d1decbcbb2832b0cb1585482ee22043f769deb2eecf9e2f4b3900e6ac11b18fb8f104e38ed037fea6c76fa9c94a33119058bb6e5dec52d63b25eb987
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
2.0MB
MD54220c9aceefecd6063f984abbf55aea8
SHA125c06852275faffbe05c5d0264c8668a91ae9c66
SHA256d8bc62b302f1e2e7c8d477975577709944b7dd0fbc3f57f8dcb1befa581cce1f
SHA51242a61fcbe97bcade331f735db783b39c449aa35aa3b1ec0d67b3b2070837ad0797597bf94b0705f9892bff4e41121dae46877e0ba5d814f035c794310742ffc9
-
Filesize
2.3MB
MD5d1f60a85693ba11c13570ab858d44fb0
SHA171a36a009323ff87cd8531f2529a7f68e6f8ef4e
SHA2568d2ee003b8b2409094729575af877e8f2c2492161db1cee3ba712b3832311b07
SHA51235ede50c510c315f9708caba1d155e3475eea2928a97d05d3dff902befd1381621be8f8e282614134fcd80359d7fc13b5e086aaa35a2714e3a31fdccee7452b8
-
Filesize
2.0MB
MD50cb3e7d7b791c3503f27d0dd5d33a753
SHA1b7f7eba7d92d7fd5d58db9991dd166e68934b99a
SHA25684a89a684bad218b6b19f6b89a83edbb42c75c9c82914fc429955823c28a2f49
SHA51220916b0cfaff67ecaa0f33a85b985f16bb866332868113383213778f638d7fb7df50ca542394207fbb9351988aaafefcc589effde2f2910c5dfe87d50ff12757
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
28KB