Analysis
-
max time kernel
177s -
max time network
188s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22-12-2023 17:11
General
-
Target
fc0aa6dcbc1cfdd09dd1e8bacb20ef16.dll
-
Size
1.7MB
-
MD5
fc0aa6dcbc1cfdd09dd1e8bacb20ef16
-
SHA1
8840124afefe1d0401b17f9cf49403699eec6872
-
SHA256
e98ec64dd1a7e8a99356a9ee5c619df9d93bc0be63df2ea03e30c01d37b4da2b
-
SHA512
42a0d90d28ca5d75c915a777502543fc3ef77f2edfe60cf155b91b840693007a88a60c2a3722f2663832292027ae1149d9098b0b34f3c81d914ecea35a0af911
-
SSDEEP
12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fc0aa6dcbc1cfdd09dd1e8bacb20ef16.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\qVV8\rdpshell.exeC:\Users\Admin\AppData\Local\qVV8\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\3n4\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\3n4\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\n4UhoG0\Magnify.exeC:\Users\Admin\AppData\Local\n4UhoG0\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.7MB
MD5ee1e9eb98597b527f36bceec1647148f
SHA11d748b20a639cb5a87b6a202726c48d9612dbb50
SHA256eee027b8a20c240b64611ea48e78b285b60f9bcb0261f1ca4061a74026ea0ce8
SHA51233eece0c572a1cc9eeff4a491930df2ecd39dea4e866154ffd6915219d37a4aa349e4057c7892f226c9c375e0049af9b919875e88787e97140ad142fdb65d903
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
619KB
MD55b71a21b82720c7006842c71ab606f7a
SHA1ef360935001da2e9e4799a070e415b8a83e6fc18
SHA256b3b22803f79bb9a80c58df9073ee1f3c95a8e6df60b448c81781eb6b85753957
SHA512ef7c5b1732c2d226daed68caac5145009273594f46438f2769d654069fb7ba17f06c188773dae74a443da2651fa99924b7357416a87ba46c3a13a7e43a2a9a28
-
Filesize
776KB
MD58971b4075b9f316ea6030108fa7ef21f
SHA17c786e61d359039d1e48c9a8ed6669bd6e5a5289
SHA2566c4996ad8856d45187239df62a2247af2c6d88586c8d6223136bcaecdcf5f043
SHA5124209c59092f4a7d9f5a650dedabdba4482816b3036b38de710b80f563da52b8899fd36036180e47071b625956752f5aaaafb43c88b96bcfc6d201bdcf2a68800
-
Filesize
485KB
MD51e3d445c811acc3caac86a43ad6569b1
SHA11130d1ae34c7e5ed5590a3a40ddbf9375ae4d2e6
SHA256df8b3c07f11fb7b90aa3db76b155120d33168b9e9e45d5c75004a840815088eb
SHA5122490b2999f77e20868b42245d9d04d2ab2cffd1c077594340d448b8aa42b502d4d87faf8883050e2153275549f9c21d09ea815235234d11e65961f6e80abf894
-
Filesize
854KB
MD51f466ebdea280446a25dba16c4f72976
SHA13c88b1827727f5c930d7ac982afbd4b9f018f7ca
SHA25616d365fcb89f9fdd2615c424633713ea16b4ab85d9ffd753afabff988817bb18
SHA5120511832d73105925ff2be267fd86715ca4a49cd1d5049abda798ab88bcdfb349ad02ac0ea3fcdbcea92b5f473fb6545b7c3f42dacf83ed18d148aae015cdd657
-
Filesize
211KB
MD58d7ad06e2b4867da47cc7c7bc6230f01
SHA19c474659789fe945f195743b07afb741598d2e20
SHA2564b00a3fa84f73e9b10624a802f42917d1ca408b375e37aa12184c1504e5ddc36
SHA512c47c3d0fc16edbb9c03d034fde55266b0cf4dee40fd9cbcd93588c8fdbca3c7fc21f92e0cbcf9e6c5eeacb4fe76f9b2c77fe0a86991ab66c26aaf146dccbbda9
-
Filesize
275KB
MD51dd9b45cf5ab19c6bdb63796eb3096c6
SHA1500cbd5f21108e44ea2ea536341f7e5a6ecfca8e
SHA256886ac2e8d0f0fce428755bc7bb4f6100fcbb61fc48e81b3a303849411f1555a4
SHA51270e54b513bbc6003f7662e6d08446653af12fd23098e5cbb1ed38efe72d74278a711c1d0d54f8fab6459ff114c7a1b0d6dddbeef8d78c7ff99bb7a171d1d873a
-
Filesize
278KB
MD58e8b65c44b276a55ab8061959a4d432f
SHA184a0e1dcfbca3dad31a180a19afafaa9bf895b9a
SHA256e8ad5833edf06c2e88d70a5d4de3ceeb89a2f397fb7c4156900ab601830a7ba6
SHA51293d7e90c0f58df48684667098007105bfd64913456c251afad6ade7871a64b738db86dad68e1f81492fc9f7b5a989f1124573b6513a5d0eac827fb983585096c
-
Filesize
235KB
MD584ce3b249c8dc5f87b57d2fc254a9864
SHA1a2125553dd3859ebc3cefcd19ce9672d86d83a0e
SHA256ec30885e16ed34e5141767c32c86f7b96421a643c6f25eef4dc0a67fcf84cbec
SHA512b678c7e269c899d24666ddc8bdd8158bda4600f53fc374fa96d019c9c03be7d59fb1256fd8409f7d96e34176e3352c81055e0c62548e4723977a00269c9ddc03
-
Filesize
1KB
MD50fea8d7e3ae63b413084fa66ae3528ca
SHA188294a8d45191bca1107d2fe402418803a43e244
SHA256879fa9d922dbdaca0dbadaf52355b93b9739eae8784dd2c83ebce3f044469ba9
SHA51288ecca9bf65779c2c2fdb2209ba3ce7234124cc0e45c173160308b6aeacc335ea978ecfacfd950e621cfde4b3d36f57a57f7fafc2c08b2d1611da543e53a5975
-
Filesize
1.7MB
MD52a103daa9cc9f1e5e4e55f861f4ac7a6
SHA12fa5e301ae32baacd2b5cfb1fb094ea6ab5dce57
SHA256e503821560c4c905e982d90a299a90b464fe2c89b4b09a914f9ae0090a65b03e
SHA5128af4458650f47aeb4d9869691e32a66cc908c0788a00618e9c85127652b93adf1b7d1786ae780c41ca5257a1e6f58d3ad7881276988ea6ca978ed771bd6b9230
-
Filesize
1.7MB
MD56dbab8748dec9d1b0212edb70680fe92
SHA18e3648a63da67b19680fa2297af6dab16d9465d7
SHA25628748076c4a4cc9d8d3836196301a534616b8e4facc485528cbb18dd2ac5026d
SHA5123a15c3d2f0e345ace0e4a94c715f8e433da51f19f9b4391a29a16f041024bd0654fceaca2190df3373d155ff5c88802cf61839d52dc87c35af676816a8ff2eff
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB