Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
26/12/2023, 04:00
General
-
Target
5274829dfdbd08c8f993a4a31d3d6073.dll
-
Size
852KB
-
MD5
5274829dfdbd08c8f993a4a31d3d6073
-
SHA1
a4f07ed425b1a4002efee120f3aacdc18f2e4e2b
-
SHA256
14906c032956bed15a33083266a615ff7d5b24d84f0dbc36c3e245a3e46ac500
-
SHA512
d65c192609e4d7c643b0305901c94188245b18e87d9417068c937a5b569bb913264590e37a0da00c96d8ce3640e2a5f040f9ed771c966551fe3febdd7d70fe2a
-
SSDEEP
12288:hkbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/R:hkbHkWfzZ5adwLNGeStHntqN7v
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5274829dfdbd08c8f993a4a31d3d6073.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\jqNlwmnd\spreview.exeC:\Users\Admin\AppData\Local\jqNlwmnd\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\fmf\Netplwiz.exeC:\Users\Admin\AppData\Local\fmf\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\XF0jjxz3\UI0Detect.exeC:\Users\Admin\AppData\Local\XF0jjxz3\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
MD533b74ac6c89f99da4f8c4080618d7039
SHA154bf25a081b153d1aabe7b4965d34453653a5941
SHA256bf48af4daf0d90a34172f0f78684d4899d1343f6cdfe475af65402fa46cf3c55
SHA512ae8dfb515be28fab573780fe617735f78caf3b9e69d535221e22f5706469216cfe9543f8d88144ba115b405b5f6bf9096e1a5937e08ec10ae6e0a8b6231382a6
-
Filesize
856KB
MD540526cf39374af30b67ac410be671c32
SHA1dbe04af72e35989241302e4fcb6f371765cea751
SHA25645b15ea44d53f3274732eece427605b65e535d0f3bc76cea04fc79f61570cfd7
SHA51232ba9da0a044efef88b86bf03ada526d27fee1fcae64d8e8cdf6aa57e0c19ef0fbdb2a53774ca7abae43ac42beaf1e782772ed45c3896f0c430e0d481f4c7f68
-
Filesize
856KB
MD5a3c4b642b1717ce1269efceb1de32bc5
SHA12967f669c0b4bea6f6a9b2df874342704bcfd85e
SHA256808c7e5ff6617a3de6b0514f3ceb29a423e069775a780fc866351b2f49c974f2
SHA51233be8b447a8329932bdfd2aac8f8032b6c23026ab30b2fa80dd3f86f7ea212ef4b22ab7d3d682b947ea0e1cd69d62984b7251405486af8e26906a2b50a4d03bb
-
Filesize
1KB
MD5bfc76b6e3c952b6c374fa63ada4e82bf
SHA1d5d9ef3529797df35a3b172d7a87b8e6949e586b
SHA256ce61a4cde43d90511820e848a33d6ed9aa0b8e9618f5a67d2352a9dccc9aeebb
SHA5120615fbbf427dd83dab3fe8caff064039dd7c2cc5011c9720fe338c81284c1ed02a0131e60f0241213661683ff03f1d060916f61534bb001c2b1c38eccff47a42
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
26KB
MD5e43ec3c800d4c0716613392e81fba1d9
SHA137de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
860KB
-
Filesize
860KB
-
Filesize
28KB
-
Filesize
856KB
-
Filesize
856KB
-
Filesize
852KB
-
Filesize
852KB
-
Filesize
28KB