Analysis

  • max time kernel
    0s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-12-2023 15:58

General

  • Target

    e3ddd19537fbfe6e4dd6fd445c3f6e3c.dll

  • Size

    1.5MB

  • MD5

    e3ddd19537fbfe6e4dd6fd445c3f6e3c

  • SHA1

    f9a944568c74a806d93ce6315e0db57dc5cbd86b

  • SHA256

    688f0f9ec8429037d5775788166500e6dac955c36caa2eab4e6b16d88c07d370

  • SHA512

    0320184082b47982b2fdec30094002cdbed0cebaf83299fa089a612d06117581f7206116ac76e656674e8c08d6f55db890465b7b4ee53687d1e901fadc2cfb1c

  • SSDEEP

    12288:oVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:9fP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\e3ddd19537fbfe6e4dd6fd445c3f6e3c.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:996
  • C:\Windows\system32\wermgr.exe
    C:\Windows\system32\wermgr.exe
    1⤵
      PID:2220
    • C:\Windows\system32\mspaint.exe
      C:\Windows\system32\mspaint.exe
      1⤵
        PID:3584
      • C:\Users\Admin\AppData\Local\O8AcsueOC\WMPDMC.exe
        C:\Users\Admin\AppData\Local\O8AcsueOC\WMPDMC.exe
        1⤵
          PID:1500
        • C:\Windows\system32\WMPDMC.exe
          C:\Windows\system32\WMPDMC.exe
          1⤵
            PID:1768
          • C:\Users\Admin\AppData\Local\UEo\mspaint.exe
            C:\Users\Admin\AppData\Local\UEo\mspaint.exe
            1⤵
              PID:2856
            • C:\Users\Admin\AppData\Local\9je6\wermgr.exe
              C:\Users\Admin\AppData\Local\9je6\wermgr.exe
              1⤵
                PID:4816

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/996-0-0x000002599ACB0000-0x000002599ACB7000-memory.dmp

                Filesize

                28KB

              • memory/996-1-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/996-7-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/1500-94-0x0000000140000000-0x0000000140184000-memory.dmp

                Filesize

                1.5MB

              • memory/1500-93-0x0000026ED3140000-0x0000026ED3147000-memory.dmp

                Filesize

                28KB

              • memory/2856-113-0x00000130771B0000-0x00000130771B7000-memory.dmp

                Filesize

                28KB

              • memory/3416-32-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-46-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-30-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-43-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-29-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-48-0x0000000000AD0000-0x0000000000AD7000-memory.dmp

                Filesize

                28KB

              • memory/3416-56-0x00007FFAA9700000-0x00007FFAA9710000-memory.dmp

                Filesize

                64KB

              • memory/3416-67-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-65-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-55-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-47-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-45-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-44-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-42-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-41-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-28-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-39-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-38-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-37-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-36-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-35-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-33-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-17-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-31-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-34-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-25-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-40-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-27-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-26-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-24-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-23-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-22-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-21-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-20-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-19-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-18-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-16-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-15-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-14-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-13-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-12-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-11-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-10-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-9-0x00007FFAA7C4A000-0x00007FFAA7C4B000-memory.dmp

                Filesize

                4KB

              • memory/3416-8-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-6-0x0000000140000000-0x0000000140183000-memory.dmp

                Filesize

                1.5MB

              • memory/3416-4-0x0000000002BC0000-0x0000000002BC1000-memory.dmp

                Filesize

                4KB

              • memory/4816-76-0x00000280139D0000-0x00000280139D7000-memory.dmp

                Filesize

                28KB

              • memory/4816-82-0x0000000140000000-0x0000000140185000-memory.dmp

                Filesize

                1.5MB

              • memory/4816-77-0x0000000140000000-0x0000000140185000-memory.dmp

                Filesize

                1.5MB