Analysis
-
max time kernel
80s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 17:04
General
-
Target
faff1cecdbec225f5f4a12f2afa66915.dll
-
Size
1.4MB
-
MD5
faff1cecdbec225f5f4a12f2afa66915
-
SHA1
0bc116efeeab88744b461d8c7979c4bade196f55
-
SHA256
aa794827c5c65b5416d7f2454cb2376816a74c9e0d5d6ed83daadf07ad335ff1
-
SHA512
83a90171fcd5581fd0747b3d106674c8e2935613fe906cea4dd627f3f6c420810e576a42995dfa670e06dd35c84aca7217dfa14a89c131bedd25797be6ae72c4
-
SSDEEP
12288:DVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:SfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\faff1cecdbec225f5f4a12f2afa66915.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\x8DrR9Hn\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\LfxZ\cmstp.exeC:\Users\Admin\AppData\Local\LfxZ\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exeC:\Users\Admin\AppData\Local\mGyu62TxB\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ae0ca49d01f30eddd26c6d24695353b9
SHA189d77e209ed0abdd8ede3b97f2c55f74bd109622
SHA256c625aeb8b3bdd1692349ccb03f3051d06c40353bd61810c4db0072292c113514
SHA512c3acf41d559ecf7237789f136b74b1d05bdd7c2fffba0f4722246fd32db465fb9658e2e11ebf133df0c4029f178b89ed1760e54ddf063046cff6bff87f7edec2
-
Filesize
381KB
MD54fe4bd8a52e1ae11aff28b63bc777b89
SHA19228847b2e6d21a2bdd66fc5c45a9b9dade80011
SHA256bba8b5e09331debcfd36d968a104ab926b0784bec7e6a0075f3bac1a92700dc6
SHA512ee09a5300ee3b2c3a358e9b19417040442a19086854e56ac5d334ee62af5e4f92a86280cdbe03fc24a88cd95cf4e0ccebf8675b1cc3fa01c80476d7bdffd968c
-
Filesize
92KB
MD505ad85b1594fdf2e52051ed047c230ce
SHA19727b8ef5ad4b126c3f8972b77c310d4f2093a02
SHA256244261a520f72f9452b1e65ce941876d0c437619be9b5ba24ae77d5da02eb71f
SHA5128534fb755fedbb540ef29928fa5cb1381d86b3af326d32da3d5448b0335bbbad6eaafa557cd83c27f08401cf5bbd368f30dd90545cb7d9ba13e6f4c7533db007
-
Filesize
1.4MB
MD58c1eb45f6e36222534f0f20ee2b44ece
SHA1166dbb5c0fc0b48903c6f961cd452cef1e531cb8
SHA256b69d2b8bcecaed68d7a693d623fbd81f103aeaabda6b017ebace9498c8f2402d
SHA5126595cfafbbfa2530dddd3cfec6e296332f630e91375a7c2f3de9a75d3f941d72f09976dcf892b4168476bd14373f214401e62fdf8d9fcba101e91d25a63ea484
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB