Analysis

  • max time kernel
    3s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2023 18:58

General

  • Target

    362efdb462f7563b069081e0de821389.dll

  • Size

    696KB

  • MD5

    362efdb462f7563b069081e0de821389

  • SHA1

    3d2f676e15b6d677c2e77edd2b5d4aae009423de

  • SHA256

    36cce483a655202788e541b658a2c9afe18d4b1868199231874dd1c10fb8962c

  • SHA512

    4afa497167ff9b93001d04052f4757e0376c6fd088a1d531691132ca53581bf0f0cb4047b942abafafb3c06e110eee9e02f4ffb50d28795ff7d3bd2e8fbe0362

  • SSDEEP

    12288:MEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:MEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Dridex Shellcode 1 IoCs

    Detects Dridex Payload shellcode injected in Explorer process.

  • Dridex payload 9 IoCs

    Detects Dridex x64 core DLL in memory.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\362efdb462f7563b069081e0de821389.dll,#1
    1⤵
    • Checks whether UAC is enabled
    • Suspicious behavior: EnumeratesProcesses
    PID:2480
  • C:\Users\Admin\AppData\Local\1pMz\ie4uinit.exe
    C:\Users\Admin\AppData\Local\1pMz\ie4uinit.exe
    1⤵
      PID:4964
    • C:\Windows\system32\ie4uinit.exe
      C:\Windows\system32\ie4uinit.exe
      1⤵
        PID:4660
      • C:\Users\Admin\AppData\Local\yNLrN\EaseOfAccessDialog.exe
        C:\Users\Admin\AppData\Local\yNLrN\EaseOfAccessDialog.exe
        1⤵
          PID:852
        • C:\Windows\system32\EaseOfAccessDialog.exe
          C:\Windows\system32\EaseOfAccessDialog.exe
          1⤵
            PID:2636
          • C:\Users\Admin\AppData\Local\b50\SystemPropertiesProtection.exe
            C:\Users\Admin\AppData\Local\b50\SystemPropertiesProtection.exe
            1⤵
              PID:1548
            • C:\Windows\system32\SystemPropertiesProtection.exe
              C:\Windows\system32\SystemPropertiesProtection.exe
              1⤵
                PID:2644

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/852-62-0x0000000140000000-0x00000001400AF000-memory.dmp

                Filesize

                700KB

              • memory/852-67-0x0000000140000000-0x00000001400AF000-memory.dmp

                Filesize

                700KB

              • memory/852-64-0x000002D3A56A0000-0x000002D3A56A7000-memory.dmp

                Filesize

                28KB

              • memory/1548-78-0x00000283C70C0000-0x00000283C70C7000-memory.dmp

                Filesize

                28KB

              • memory/1548-83-0x0000000140000000-0x00000001400AF000-memory.dmp

                Filesize

                700KB

              • memory/2480-37-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/2480-0-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/2480-2-0x0000029F498F0000-0x0000029F498F7000-memory.dmp

                Filesize

                28KB

              • memory/3348-24-0x00007FF8350A0000-0x00007FF8350B0000-memory.dmp

                Filesize

                64KB

              • memory/3348-3-0x0000000002B10000-0x0000000002B11000-memory.dmp

                Filesize

                4KB

              • memory/3348-12-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-11-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-10-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-8-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-7-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-6-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-5-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-13-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-22-0x0000000000DD0000-0x0000000000DD7000-memory.dmp

                Filesize

                28KB

              • memory/3348-9-0x00007FF8344EA000-0x00007FF8344EB000-memory.dmp

                Filesize

                4KB

              • memory/3348-14-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-25-0x00007FF835090000-0x00007FF8350A0000-memory.dmp

                Filesize

                64KB

              • memory/3348-23-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/3348-34-0x0000000140000000-0x00000001400AE000-memory.dmp

                Filesize

                696KB

              • memory/4964-46-0x0000024AB40B0000-0x0000024AB415F000-memory.dmp

                Filesize

                700KB

              • memory/4964-47-0x0000024AB41B0000-0x0000024AB41B7000-memory.dmp

                Filesize

                28KB

              • memory/4964-51-0x0000024AB40B0000-0x0000024AB415F000-memory.dmp

                Filesize

                700KB