Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
22-12-2023 17:17
General
-
Target
fd3c39a72d024833abfc4ffa2c7b6200.dll
-
Size
1.7MB
-
MD5
fd3c39a72d024833abfc4ffa2c7b6200
-
SHA1
1667b1adb7b2ec5bddbe58321a67200b5335249b
-
SHA256
7c5e216954042551a62e65b75b021e27d4d86a814dd36003caef2925e7bfc4a3
-
SHA512
0ee543473cee8f69397174cf32191e696d9e6050996459ee7782ca94e135a7ce263d36cc284fe49b9eac8b5ea57e3ba7fa8317cdc01fcacdc568871543430986
-
SSDEEP
12288:7VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:afP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd3c39a72d024833abfc4ffa2c7b6200.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exeC:\Users\Admin\AppData\Local\TVKMx\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exeC:\Users\Admin\AppData\Local\uxvPwL\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\m8X9\perfmon.exeC:\Users\Admin\AppData\Local\m8X9\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5effeaf9634af5fb705876ac6c555c065
SHA1ea1119419dc29fe0f6196f4e6a98da1517f3a520
SHA256247c78bb9a9602fa33f3c7f7a0a5d60de9224523afcba569d1f41fa02cb2a12c
SHA5123f880f7570c5afeafbdef06254b6a9550bc88baadd762823890ba5f521650b99aac7b6578f89fdfae1d67e71904c4fa3611267f4209710c3436a7d357bc6bef6
-
Filesize
1.7MB
MD5e5eaf976938ee824e6680565d4e5c59e
SHA19f9b3910daab097e04bbe17225e41fd993575f1a
SHA256ac4379904636dc08ce304902b4b816d12a6da1b7836728218077bb0c9dd037cd
SHA512543d6092199226fb8c14d4cb00b129edec60d2802c01324d95684b137f1aee3c47895b61e1084dd6d922823ba06a596a82acc652c871382082c84066fa24e549
-
Filesize
168KB
MD53eb98cff1c242167df5fdbc6441ce3c5
SHA1730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA2566d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35
-
Filesize
1.7MB
MD54666002e3d81468ded4ef524df2dcab6
SHA176af20d44f886e01fabcc0a03934d5c21107b6c3
SHA2565c55bb9a84745c54591427ebc86bd8363692fe13d22f3ef250a7a76ba1766f23
SHA51255d6021ff4ab875b84fc1d777749a6a94fa17c136929c6c118190cd5beb597fa375ef71e435df98e26e49bd1421785c0d4195027ed67e0123e7db2b1585e8581
-
Filesize
1KB
MD50d526736e4caeaca616f0d57a6241af9
SHA1bd5d7adf152cf7ca6598dbf0309e8eb364357051
SHA2569ab6e78eb3070e16dab85b7a10c7c25a1f2c738d46632d10317c4d52d370e5c7
SHA5124b10ce3477f2e4edb1893a3d662a55910a5fe32d08ad459418e32cc3eddd6cc08bc6bdfc7b220faa95c0cbf1cec68a3f801b06ac47d82e15f544029405f06168
-
Filesize
557KB
MD568cdd0bbe7f21226a34ba537247274b8
SHA1a3f7b0bcc054a5293a598c5acdaf6e30ad4951a4
SHA2564952a017226da95737c209f0aad643da4f5fa79253791a5ee92b72949388a93b
SHA512e0b50c369c6b61c07c2c8a8bd93445c4c3b4d5f26932fba2c38ec5aeb06e25e0e5df3548301826841c89f907c626ef5ae186908d478e0693e5a0dfafecd48295
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
28KB