Analysis
-
max time kernel
3s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
31/12/2023, 02:09
General
-
Target
23f9722883a35d597e3c81e25467946e.dll
-
Size
1.8MB
-
MD5
23f9722883a35d597e3c81e25467946e
-
SHA1
cb4c7efa90cae0fbc9c09006309070b9009cbe21
-
SHA256
574f1ff94f0541c9f61e481da5571b871f08cc353dfd3e7ac3f26db7c48092bd
-
SHA512
4e024d71ce8fc26a76b26ddbdc92a2476bede0cd4c65eab92c7f0ac597246e2a32432d8e67d53729434dd2cffdc6aa0b40c2f5ff634e21333c7f2b8043e2a7d6
-
SSDEEP
12288:cVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:pfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\23f9722883a35d597e3c81e25467946e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\8cUn95O9O\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\8cUn95O9O\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\jXHH\BdeUISrv.exeC:\Users\Admin\AppData\Local\jXHH\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\2Ex9d5\wlrmdr.exeC:\Users\Admin\AppData\Local\2Ex9d5\wlrmdr.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD55778498d28bdd0992e7f14021f31f431
SHA12e6aa54a115f9bc52337f85db5257c4ff8175969
SHA256087775601141028da6c411938419ab2213b35138ce5e3aca66b3601386b8ae07
SHA5124cd5bc909b3fadeb14be3dbca3c939a63f76e3fd4a40368b943c89e708f858537d3b9f3314edc70a38ba24869bb270548ee8fd3beb3d8f817c972bde4bc5d4bf
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1.8MB
MD59e808ed225d34e28d10df34ec73d7b0e
SHA112c05a360e40475b5ff611795129a4d5ba1096d4
SHA256cc115559b99e76c3d6a2428b314c176b7dfdba1a2bc1d98a054bbdb59f1407e5
SHA512edd72bd01efda4d0dc79c365d2051f126f48225948086767df7fba4f01a5ab8f62d9eb797c4c164f4d81dde466da8b135c8a0feb147df4ee5fe977183114e8d1
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.8MB
MD563f58594c3fc344df441728f8954142b
SHA15392b49d41c2feb6cc7146b6375602872e2c3754
SHA256ae051b68bf8b35c23e0e009e30b7d4bd374964434a8aa694eb517ca917462aeb
SHA512bea2b9db9280c155008be31643daba115e5d5580e5a5c34fc18c267b30602040fb198d29a0c04cf0edb33d168bcbb67f09c44b24c5baa1f7ec312767b0798940
-
Filesize
1KB
MD5a7b703ce61296ecad7855ba80484317a
SHA18ed17a4c94b0f4812d50b2273c602bed42dfd71b
SHA25675cde7b27755679086aaa4bfb5e08833da5ce90d82aee92d145e1eced70addac
SHA512ec2130dc0e193141bd9b0a7fb97816cc2c5b192aa2ffd0dc74933de4142197187bcb32f6715f1e391078f28eb96e24025c3458f3f60a3f4033deb3a3c50e7563
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB