Analysis
-
max time kernel
151s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22/12/2023, 16:48
General
-
Target
f7e4cd098d36760819259c353ee7c0d9.dll
-
Size
3.8MB
-
MD5
f7e4cd098d36760819259c353ee7c0d9
-
SHA1
22f6c0c60280a9153990d61d21919e2f1ecadbb1
-
SHA256
a6a2651b94c935293541f8f92998be8d30f6e0ace01ff02fc931dc834bee9882
-
SHA512
375e2848b9b1ad6bd6ac38d204bc45dad430e2e61a2c943d23b0257e240bd802f730af4c5fc208eec6cb90a4ccfb027b4c5114c5c2992ee20b1c082571ae23b4
-
SSDEEP
12288:aVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:HfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f7e4cd098d36760819259c353ee7c0d9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\tQF2OpN\spreview.exeC:\Users\Admin\AppData\Local\tQF2OpN\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\hNW9fX6K\xpsrchvw.exeC:\Users\Admin\AppData\Local\hNW9fX6K\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\V9Hr\msdtc.exeC:\Users\Admin\AppData\Local\V9Hr\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD525accd6f9cdfba761871d0c88b035be6
SHA132da2c5d41c939b8f708cde08ce98a1922325409
SHA25600bfe17e6f73e89bad392857ff96616373095701a31980836a82dabea0e04e91
SHA5127dd193a59f2ce32c6fe409aecc6262b66c54f51ea90002016c046d8c0d24b052185250ab7076030de5d127a5120cea7d6de0fa23e49fc862aaa25b7e9ee83690
-
Filesize
47KB
MD52e88833496888c60b454094781dec33f
SHA15aabd230d0bf79389226bc51135e30368803c915
SHA256e5890107fd3b94c93c7c68f5e5bb4d7989e97ac14bb1c6ef7954b5ac2e319423
SHA512dcbe1b2e557f19c7ae2b5016a5b196b31c46990bf6ab02de6e1c6e43f0803efbb5550be6e7277b6938b92ed6be3d9adff45a6ce409b8ff680335f60503a76c36
-
Filesize
37KB
MD5e16bb9da49d880af2c9dfdbb9524e764
SHA1a70932a44595fc332166b53e10aa0835d159266b
SHA2565f5e5de07138970c9a6c33c4c04f056087f4a3248c43570becd4a2936cf24865
SHA51244932762f9ebef12727b3ca9a689ea8cf82f30f3859be00016b20191d446e4c83f3857017e85a6462076d4ac5c13c93c6615fc7c934db5f054dda9a13cbc89f3
-
Filesize
1KB
MD5ff44f4fd312483538601165f8d0e934f
SHA1d1fefb86a84078b1de3b971178458289fd723386
SHA256ceb15cffba2552fca35934b7a6d00387f1f9e79a90950043a94be31078808fa2
SHA512dec6fc651ab8d20ebfb2de1bcf0376ead8471b3ec48f344c2cfaa6e76bff1e294c8f525018e3a59497203a6effb4316736a57722e075923b852edf6aeba75598
-
Filesize
61KB
MD5baa7563adfa7d743031f4c0b031f5083
SHA160e1979f0462241c45e9d2cd869f6aec75d0cb23
SHA256878a9c8580bdb9e57784be0ebd3e2f6db4e3b6c9e9ae86a9f492307910b42ce4
SHA5126b950b1036a2427da776be9cf3b594648eaa32eb09dd034613954cd39068fc0ffbfeae7c03d1221b3753ec998c1a9dacff4e36552107e463e3daa402af20bd9d
-
Filesize
73KB
MD57540460b1f5d83f336890635cf71b24f
SHA170d1450233fede584fff94ee3a674909633cad66
SHA2569d764d9dcb74a745518c92e079335d2ada0886ef7fa5712e8baa9ddc5a547493
SHA5123c0302307e2467531dfd2e0781ef1870db9c859b5583fe4462555a25f4822f9c40282bdc923122a472ee6fe9e95d58635b1893c7aa5c1b4c7125c41731e50a19
-
Filesize
125KB
MD566020df9bd6e12b52957b2ba0c7a941f
SHA104d450b9f6b5bc8f9de9d693acb70bd83d2f3b39
SHA256986c4ac9a3e35b9be7e859174856da88b6b1e8ab1a810f6841a133fb741850a6
SHA512655387796e67f00283f5a345d2eee4ac2c12bcd19e2dd520f05aed144ea046b87ab64f0e43417e93a6e79bc2be2e74778301c44d5bf9f0c505e27ccb55cd771e
-
Filesize
130KB
MD5d52f78ad36d471738240146c6c76c6e5
SHA1ebfd27625e3b26768ace5f82595f5df3b7e1fcfc
SHA2566dd387e9e5d0014c564e9d12134152487a6b5e68e3f3b6942f598efcfbcb1356
SHA512d2b914ca19dea12dd95b30692fe390d1a9ee90c2f45bdc4832670d695e7bbe42fbcac37b96ec769ad493a26947f4a00d31618b65f251d3d72cf60b70e303ac41
-
Filesize
1017B
MD566d17e1b0375e65ac502b6e66476f34c
SHA147c86e02cc39c26bcf450d3166331d6b92211907
SHA256690c813f26896198cbb8feb393b01bd777039958016a53fb91d398fa67af202a
SHA51207ea20b5b187dd8ca47b8e06d146d40252acc2015c4690e5908df8c6dddbe33f992c1def8d1abac0866d0a42c78d17bf9883b5275e1a6992703d66a3cffa6adf
-
Filesize
96KB
MD5883f23981021d0880384ba2e5d931bdb
SHA1962b6f90581a8ca1abc80edc9b306f80ee1a2268
SHA2560bbd1ddd054848d2b7c08cdd2d813ae858af761fd68b2a544a079884c2d5b462
SHA512d02d91a52e5189315f3545012e2328168a72fe268981a64683acf61cddaf231a50c440561039876762d1a3d92b26002f4b913851add3c6db4ac3f743167b6ba7
-
Filesize
239KB
MD57c7adce8a7bc06c1651ade81d11ff3d8
SHA18da46a91f08ac968bfe2affb17b8fb6b5e36ddaa
SHA2562f0b24691c73f0d819391ad6bd6426af4441d6d18d2af9672dd75bacfd3de1bf
SHA512c29c9e111fe8442fc0980781ee5b0273b87e57b00471b299ae38f83d183cfa8095a35bdb69cbc07a3fbf245340f764cf7ea775bf6ee3e63b21831edf453d9ce4
-
Filesize
107KB
MD515e3bd775866454759a3e09e57dccd36
SHA19c95c7fca9d4b5c2a1d34339e226eb432a428004
SHA256d5d662a208a81063f3ae7c40f4d2161dc34f63db06c4af2ace85a3ab27255051
SHA512e90c995ff6868656858a5ffa28b180298a5083f844e54fa1b6bfc260382e81d976e8f561cab5b74655586b53d749f6a4339cc91801603436b41ac8dea9e32ee0
-
Filesize
85KB
MD54da7440c440e81e157b7b4fd47dfe5a8
SHA1cc456fc82365d3e480412cfe54e9e2839af23614
SHA256348e4617c3608ed729d373366293bb02cc9faafe6f041e5902fc508e86b640ab
SHA512e1579e0a712717742d903f7d818b80be7888e7322e938623c0ca7ddb4c0eae8ac3d06ee9117e0a784e274da7eac14ab82256c8fe9483af885bea2d7c269f350f
-
Filesize
101KB
MD5e247a2ba0f5fb731c0130e557e29f4a5
SHA10c490e2b5d2129281a2eb9cc37eb823aebcc83b4
SHA256eb894267ed639a77c94266bea70f9c1c9078c956281fb646fe4ef44ece1a7119
SHA5121796d0bb586e3dcbe6cb76bd77daf7ad5e1cfd09ce9679faa6e38fbd4208984ec87e1ece63339d330d9f548ff38bcfe448dd3c9cb964517f864eb69491e28d62
-
Filesize
4KB
MD57e3ec4fb58d900f599e384cdf707f890
SHA1ab9f445e516905e31101999476b9c1a1d1d27d19
SHA256054d000074532d5cdad0dfc97a353cc5514103b8a3fc4979655d78064effb886
SHA512e9cde36a253ed95d58a00828e8385e0d9f87923f3d64aa1069fc1bd32e2aae5099bd172b7c4699856618f1f9d325ac9b3bcaa854e395e1160c44c96407f01ac7
-
Filesize
45KB
MD5103391d5f114da716b7bf73f3e1fdb7f
SHA1146937de05f7b933230e73cba3a2b8b73e3b0a76
SHA2562cd9fe5e746ff2c9b3c76b82ee1ec358af33332f0c16f067e230b12bf8f3b73f
SHA51286d022403411e176850285b75db3fdc836921584dcb0059056a746274d15ecce40b0de6a98ee1fc8d9c67990851eb17ad009aae19b9f50d2b0937cfc1ca12223
-
Filesize
65KB
MD5119778ce6b919e7e2e09b5c1f0241a24
SHA19a95f393f86ec5f8171d1d829932a3e6d33804d7
SHA256c96d9520e75ec1ca151fef1c0c9304fd90337ce57849ac29886f70f4182b97a1
SHA5121ae05a915b06f8091832b8ef03f842122a7d18fd5f66da204b3a340db3ff33c403806ac7a84d1c1ebe40d9f510802c47f686b53b80530ba4959c5bc475ffc642
-
Filesize
69KB
MD5b6e74675420947ec064e945204549910
SHA10d05d27ba1b422f0ebb1774f145f9c11208bad19
SHA256739e929cde5a6ba38369a6561e595f8a42fc1cf0a82f6943c682fe34df3e6e47
SHA512fb2dfafac8fc09e3180836a13daddaafe0c0597c090baca595f85512299d8aa316dca8aa10a2798ded02c4624106f5310a70f5d53118d6e3b2bb65d281fb9666
-
Filesize
85KB
MD5e34baffdbd3c5dd2fdae15e0b2fcb366
SHA15971a7bc95bc6e3547601d3094f41e8c78e4de4b
SHA256eeff4d73eccde1719d0d94772201020041437827d4788d8a85eac4b849abfb84
SHA512cd69d2a5bcd37ce7ff9f5e828d1b0ca17fccc642b5e13fb56dd96507cba8659b84f70d16e4c81977aba4997e806cdcda31b1c658a638dd26e612ede601eb197b
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
28KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
8KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
4KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB