Analysis
-
max time kernel
150s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22/12/2023, 17:11
General
-
Target
fc0aa6dcbc1cfdd09dd1e8bacb20ef16.dll
-
Size
1.7MB
-
MD5
fc0aa6dcbc1cfdd09dd1e8bacb20ef16
-
SHA1
8840124afefe1d0401b17f9cf49403699eec6872
-
SHA256
e98ec64dd1a7e8a99356a9ee5c619df9d93bc0be63df2ea03e30c01d37b4da2b
-
SHA512
42a0d90d28ca5d75c915a777502543fc3ef77f2edfe60cf155b91b840693007a88a60c2a3722f2663832292027ae1149d9098b0b34f3c81d914ecea35a0af911
-
SSDEEP
12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0aa6dcbc1cfdd09dd1e8bacb20ef16.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\OAfK0px\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\OAfK0px\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\Sbc\rekeywiz.exeC:\Users\Admin\AppData\Local\Sbc\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\5nxEKKlnY\dpapimig.exeC:\Users\Admin\AppData\Local\5nxEKKlnY\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.9MB
MD536bcf1005ea05d500f36144c7e4eac6e
SHA143c05277507e4d6c3bb47a1bf8d55ac13aee3c7d
SHA256e429e3cca7eb72b4a970361e2ecad858f13674a0a834d82058642affe5f58164
SHA5123040a0528464715dee94b13848dfbee083f63c7b8fd3ea2c7805dcc484f98098544724097441bc6b174dc9a8f0be6afaa534d9e54865b1b0a4fd3f8f25b794dd
-
Filesize
1.7MB
MD5875ab896bdffe9d8d19b0391ad9be341
SHA11aca232eddc9b68f81c3f7f42732b1b31c71e87d
SHA256f018979bcc625cbb83eb89add4fbaf4c1510c5ac5dfd310dee3616c3af90c593
SHA5124635e6b56d551a8f9cc7a9db5e5064c70ae70434a625d79c70ef3a431a972acdac8a73e2d21d35a6c81642287eac1e4f4d4b7a325a0f526ffea355d60c49dfdc
-
Filesize
1.7MB
MD5a9218721984dac4187c16b4572fd5f39
SHA1ba660b306e77bc20fea13e2560b73fb9d1923f01
SHA2566652ded6db7cc95b817bd17b73f956c8517eaac030e39fe57faff81ce6b7ba3f
SHA51241fda941ceee537660ef9a42dc9a394e7c58b155b0995d88fd69732dc724997113513c4cc2e8e75fdd59d1ff40a8b6efca00f1f4c76d99f754b35cfb448f6880
-
Filesize
1KB
MD57a2249650fc11bd5828f150e21cc0fca
SHA14acf7b01f9196b47f2dae0b90802fb167bd35cc8
SHA256c1e989241b856ae7aebee3b6af61f42f3df74cf777ce0c5f52a1ddb48ca866ce
SHA512767054aa4896ece730acf4b7bdb65feb0d45652c21da3d75d37d8269ae3bedc078f0091a2dd0434fbeccd2eacaff8b1978fe66a61d6ced7a61fcd7b5d42eaa25
-
Filesize
73KB
MD50e8b8abea4e23ddc9a70614f3f651303
SHA16d332ba4e7a78039f75b211845514ab35ab467b2
SHA25666fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1
SHA5124feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB