Analysis
-
max time kernel
100s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
31/12/2023, 04:58
General
-
Target
2915f0ee3b4358c235bd91e7e90325c5.dll
-
Size
1.1MB
-
MD5
2915f0ee3b4358c235bd91e7e90325c5
-
SHA1
f51129c7e9c2cc23c16c6c63ef221d44831adcc2
-
SHA256
99c03fb6a99ac38d78f5c1e853acae759e8cbefdf160e7257c8f3fcbb74ccf4e
-
SHA512
b171b550248a891e5e264527198abdc25b0f6d6e34bd07f617cf4d96e00d5da489b871efc645f6ada815e8e0f96f14c834c7564cd01f14b245041a115185c813
-
SSDEEP
12288:vkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64CC:vkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2915f0ee3b4358c235bd91e7e90325c5.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\sLKsq\eudcedit.exeC:\Users\Admin\AppData\Local\sLKsq\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\cQO3Xxe\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\cQO3Xxe\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\qNd\iexpress.exeC:\Users\Admin\AppData\Local\qNd\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5bf9aae01b072df34060548afd5aa0c31
SHA1565e507455ea5c805dfd7e2d0c2b745d4b9e75df
SHA256d75b7e3dfa81db854b11d26a105bbfc92da29fe8070dcc420c1d0acba5cbbe02
SHA5125f863c33f525160267e2f3eeb0f5072ff4b55d94881fe420711d20035546498134397574bc73a01be4869781c4b786b34b6bd5a13805aea12a1913088c74232d
-
Filesize
65KB
MD5c6d856dd0577d4752a724614437a0e49
SHA161580e8df03e2582f70722c1a45e0cbe28b47c48
SHA2565ce52e878505e4f53ee1525cbe17f1c4e4a177a01844f13fba5463b5fe2478f2
SHA51256f7a5f12f8e580471ff970808c6285f1a514149b30e1ad50e872d99bcf21fd67952752945c1c255233aa6c8d38f731a196d8ac70284e4da7fe4a7cf801df2c7
-
Filesize
1KB
MD5d9fb5e7b648535d2e99cf722e6e77748
SHA13212a94fd66f0e3893e47bc1858213ecfa4fb8ad
SHA2561dee7db558463566ef79f9b2e92fbc4f14f006837541c1fdd83bc14089d27a36
SHA5122664a45064234398a269995c9075ab180158788e266579f9bd62dc7210698bf4f32bb0c8fd143d6725904b4f1e46499376b084727871bbd40b33649b4f6a05fe
-
Filesize
1024KB
MD5174039bc2a2fc970320a0ac71b3118ab
SHA1cf47a2b4caccfd882465ffbd2b337b56551b7c73
SHA25623c90d02685a7bbb1a3bd25d9e659d1e7aa363f811a170dc9c6f73b2fa6c742f
SHA5124cf26d3488cdc0ac1a28f8fc79fa1b39f4f34660e637ea7e4bb52606a82e58d0197f8bb59353b41d9a16fa0a3a88dae491e1eb20c332ef7c02110825255c4b9b
-
Filesize
442KB
MD5ed6a3d3aa37d236b35d7a1808155ac08
SHA1d7d7968ee0e29bdde351402b053972228894b0ca
SHA2569d5d4dab3d3eff61b3e3eff51c028213ddf29434982eae2115277acafccf9829
SHA512ec69dad3e064c1cb866359ff5eb8e74bc003e50307ac595101e698c0ca7879129e7437104ede4cac28736c88f708235801037f05ad7beb7db56b77784e07f8f6
-
Filesize
1024KB
MD517fdc10fd740ca5e7f830dd1ca5ab3c7
SHA138e8011d60a734ebbadf5c8e5536613841bc93a4
SHA256e801467781ba7c4fa6ef3fa87ea7060721f965a511f51b8ef1eb74fbdaa64c83
SHA51260e1cbf7777120b4691140c39ff1d23e3c0f4c2d3376f61e5fb4a93251f71a31583f251aa947f2cbbb164e41e699c1a1336f4541af2e1c40bda586cea44c063d
-
Filesize
92KB
MD5054a76f4c99be583e201604594fa18fc
SHA17fe47692f9ec5d168abce1466ff609fc17bcff36
SHA25614ed63d092856faeb0c7d83b56e6b2f3a86599e2600b76bd42f1c976d78f29f6
SHA51225f1414ea790a832751b8e854772c802630e17c9692e96576f34e08390cadf81ec21dd81b941a87048f2ca0f62eb616d1eb67b5e3c7abe6a9eb29ce8aea40a67
-
Filesize
128KB
MD5cff7f28cc5ba69ca3bd61b638859c062
SHA1372ed738ed7fe53280ed80decd688a01a772c911
SHA256a1a6d39268bec44ecb5d4f2cf29c82e2e19fbb4e30243bd9c65410670a8058e3
SHA512e361e7b39bd113b49705a9ab93ecf0bba391077ec27cc3444fc15788340bac054369a61f9b1f2572d4da690488f06822aabffcf4cff8fca6e50b9258c0b1a2d9
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB