Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
12-01-2024 14:07
General
-
Target
56aab8ab8148757ed3d270d8333be525.dll
-
Size
3.2MB
-
MD5
56aab8ab8148757ed3d270d8333be525
-
SHA1
f237bd80c955fa89473ed0c52438853ff59787e3
-
SHA256
4839189e4054f17776f8d3b668a5ee8e2bcdf4439a057a3c32b481de3e3a2f0f
-
SHA512
a16cf852e96eb14cf7f0036fab87cca980887af5072bd38f3a2cb64753a8a69b5dc14059e2d035a28b0cb9cebd3821248880b83eb9915fa96cb5f87a70c0b330
-
SSDEEP
12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1HX:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnbH
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\56aab8ab8148757ed3d270d8333be525.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\Qd9Iq\DWWIN.EXEC:\Users\Admin\AppData\Local\Qd9Iq\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\MWCv\rstrui.exeC:\Users\Admin\AppData\Local\MWCv\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\2yjmil0\slui.exeC:\Users\Admin\AppData\Local\2yjmil0\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
17KB
MD537fecb68e635f6ec2de6209a17648e48
SHA16311ce2d7f572060a0cbb4635758021076a15ae0
SHA25672209df0de3ad6c743ec363f42ddbfd781925a64de34e1c0db4d03fa11be758b
SHA51224c5467cb55be3bb0d7b0f0acb947a8e43f1be64cb9cc8620f3ba2c30df427f7630855cd59ae66008b9f637eb7120becfe9b7706b05dcb14523019e7d0f9c98a
-
Filesize
49KB
MD599bab76b9b96a2b9cb62c30fecaba924
SHA13d77a0f90a731371de04297e62053ea66fea838f
SHA256e77ba83b294e8ff5fe527600c95bb8b07046580000131807c67bade4ed558424
SHA5129675b7c8d8123e045e2b1c13b525a583a72af8ad9383ce62aee17e03924d95914103587133155f22fa39a0b77ca25d1938c15e53a12292825bbaa7c0beece061
-
Filesize
76KB
MD58701782ae0d9fb9ede32f5d83f00cd71
SHA19929dd89954b5aeae93285147a9aa527784d640b
SHA256a33957511093dedf8557226bf1c4caa0a31e2eb5fc1086e96dba5047243d39a0
SHA5126733d846b8e95850195bcaf58ad3d6f216a1886347cd1c34780f70f3d15a23e43bb05d6f27632c190c6f1bcbe0614d5cb9f8596864e17c5922190aae7ad1f5a1
-
Filesize
196KB
MD5f9def3e68a81d350f1f98604a1bb544a
SHA169cfe203f8cc00204cf536db64bb70c3450f82d0
SHA256bfc101d009648edddbd34e9f2f7644812d38b50620a96a6518b77e683cf02d25
SHA51258efff1bc114247432e8f8f5b5491b4ee8eb2fa6e0aa8df6be8edbede0e98a3b9f5726976e3385d56293209c152c764821742af143223c8078d082aa8447917a
-
Filesize
119KB
MD5c1bcbb9302b9ab01ca7ce15b028b26b0
SHA19ce73dbc9d5b3e2916eaf41f81ddb90cb6d22fdc
SHA256a230ea1cd13352eab23a4ae7ab779a552ee47a7475096ba8059b7c4092a8b823
SHA5123b1d6054278b7e0421aeb18eb86047624944914479b0095ea89ad2c35123f1ad3d6eaa52d5e3643e78a407c84cb54b6d68e448f70cb835f44ed4bd40e318deeb
-
Filesize
58KB
MD5554dd118d92e45c74304f7c9116a575e
SHA13d63b4a0f810895794edb3cfd47e7e438751e6cf
SHA256a434585aa2bc0f5df56379b4941317fb1e20cbddb908c7ada1da5fc1c5482fff
SHA512e147de8fc465d70765446b7695efe1920e79d4b502969e24b83ce37ab42c17222772cc32bc8f1df5c9038d0466a5485dbc773e6b9aa24437cdd65f7687a8694c
-
Filesize
91KB
MD5f1f711a0d445938f99a0c453919d5221
SHA12d85ffb614332c6099f0c0f014011c38154a0b03
SHA2568b8e080bc9435d45515f7501eca10fee57fd32ca6bc8bcaa1a1f575b7dcaf6b6
SHA51253bc4556b520b5f73bd1e1788be4aa4872e8e47394d0ba998720757d35f134167439f55ca85d13da25615ba93c0a9bc3d0ef1149dd2efb3e88d48c2b6defd47f
-
Filesize
74KB
MD572ec48cfc32d16ee1675108b978195cf
SHA1733f6eb3be00e79a1271caeac287daafef96b891
SHA2565ac4e285de5d3e2101413ff70222ea149c13b4f65fe7a03b93696062b36d7580
SHA512bb502a0fd74651f36c50999acf8de8a263f37649cf5c894e722934f8bca95530294dfe25b8dc30286b82179a3e32ffe8e56b9aae85144fcb6242b0351021a57e
-
Filesize
146KB
MD53dc0a7cd6b364de37686cc6f821432b6
SHA1a6b3cf709a560869ae4cb62bd1610cf21d89c12b
SHA25604c2e0bb1bfce9e20db7dbc7cdcfb90ddedfe972216cbc78f2316a51bc488e3e
SHA512e1d0c498868d2d4d584ea5610e257ec7cb8f334b7ecb2a08021ba2b11798bcbd388f7c582a1d4208d59e204c70001ddf8ba848622e856260b40c689fca7d57ab
-
Filesize
1KB
MD57e360497741356d2ac85481600480dbb
SHA1a1399084b640489862c4cd729460d5844ee93854
SHA2563fdde0721b65187709f3ac1d09a113996fc65db33b3ba74842a89ca5cb77b09e
SHA5124b4d32ca40e0b400d0b4c112e85aab77de33e2f8aa438535f6be6c2610b2f034c0a343f6e6d42796e92ca655a483d4c62114290b8db79ff1d2813c2554ba5b00
-
Filesize
92KB
MD58c11f707d756ade54a82fa510fe54375
SHA1884559becbbc8f4af7668c8720de9a3f7450bd3d
SHA256c9e5532d92941d1f464bd233c038aa14edee69156f8abfcedf2ce978377ddb9b
SHA512ac8379a81eae6d261313fd50df2389b29a61637a2ea133081e0b82c35afaf2e178e803d1583d96519e1e0d68882948f5cbb048b18dd858eed21c13131a7865ac
-
Filesize
93KB
MD5659b7b9b4dbf2a9576ed4fa2aadb16bb
SHA1c33501b362fac8bb936709b3c12283df1dd85449
SHA2560aba7a33178e671e5e6a455ea0f069aaada071d9f274f08067ce97dec3cdd7d9
SHA5126bbc947705a90fc8606fdf007fdce266591ca1eb37a6fee8ce3337480d2d79950896082271cc60add26e5179e721961548fb8d66e7d515762a48a93628317ccc
-
Filesize
45KB
MD5816d3fa72841e0f18011b28566ce5574
SHA1d33ed53d3c23dba159762562253da1c7b4ed9df8
SHA256331402e95ef0b0bf4c30195690d308b5b6e1c02dfd0598136bf5b4d7bc67ab1d
SHA5123d59e2220f64d2b073b65ad221acf0e9ef84acce9d2b8111bfc15b6217b356faa60bc832cd1005fd821ad9caa292bd1b696f46c3ddda0a50581cb83e3f9f37e5
-
Filesize
1KB
MD50d70786edee2f07478b2bd3cf8783a70
SHA16fb7f936efb61760d5517296aab8b90086fb9754
SHA256c387b5da090c6ee4ea4f1aeb3862cd4723b7e8e3a2ed53e86f91479633c269d1
SHA512e7ca94624e5b6fa6d769060671c1a580cc63a82963e8412b3b13a63e7f0bdb4d5fef49e41c81c54850ead513aae8fbdc4cc7db9bf61ed688006f30bfd795df5e
-
Filesize
92KB
MD58e443b4f23ccda60e41a108bae112f88
SHA1f48fcbb36c6a42578fe7e97bbe29350a6e14c410
SHA2566677c0ece7e8249e3046c2146deb0ffe326d3b07e8ca6770aee48403b7654824
SHA512ce330bc369933e759f0bf6a7b80bac2fb2c08d14a45d87d47e7b8ed1c0569939acfd39a761ff55ef7d4775be85f35372f688611d9fa519ea50bb8470a25fddd9
-
Filesize
81KB
MD53b13e3e94bae7b10f00e2ee321df2077
SHA12aff08a0dc1622f6c4fb7540b1f0b4a7d3909d9a
SHA25682bcd3f3e6a548e5cfb33fb89c9768b4b7aae9aeeb5d9578e31559def154b03b
SHA512a01ac37e1d9fbe5f8784ca4991a41af76bc44ca06714c33e59a50fcbd124687d28548298c35d633b5d629d2789910851fa8394c1c71c0993cb31b5d169b2eb5b
-
Filesize
78KB
MD5fe275e52e19996643918460a55591179
SHA1019da5fb45d261d33e6108bbe63354ae9240ebf9
SHA256e25c1d58c547818e462f16424736a506d5c30b4961241d6d27e3c1b9944e54cd
SHA51282e25aae2691ca6718367022254c01ee844667bcfc970d284fc20f34dac7137d25746c62bd333e16bdc44ae782ae66b77389d9f2ee5dd5bdf3d0b856a3639d33
-
Filesize
81KB
MD508da3399609d9891fa45f152c110c203
SHA1ab6227b1fbc258b0101eae2ec43a54dbe73f52e9
SHA2565d095ee4a6f869434fb795d830146be6428be29ae7aa7c40419c537dcf039dc5
SHA512ee3788b702cce922b8b97a23c6110ba1494c40d4d572ae6a4dac7284c831eb7270a7210154bf81e2a131b371d6a3abe9c7fd13e51eba1d71b000c84163810aed
-
Filesize
84KB
MD561b5ab25097f111745c27c25d8c20719
SHA12186c220111653b9e5e8467817829aeaed5a548a
SHA256709770fa0120839bf3db997a49b03414e35471b41f626a4a5c772b2c307607e9
SHA5125ada54197d32fda0c5e8c3e030eb0d722c43d6a80e1cb5189aef1747b9bd772ccb1f50c5dd2302edfe74b87784582a861dc0b04229b639e7f1af3a2e9a32144e
-
Filesize
128KB
MD5770b713861f69c441d353c973db15466
SHA171be2e9d3a3e519f6d0a62a48af813c5a6b8fff2
SHA2564bf2df58b0a1cccfde4e6da035816ecbaa18f785f87bc1b842b5e6fcd80d2234
SHA5127362a634251569272f967f79f7f37d7f70855bc5a13100a3e865503d17e7819c4e4bc0f12211b9583bea44de974a9def30eb6178535804728528e153f3ccc0b7
-
Filesize
28KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
28KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
4KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
28KB
-
Filesize
3.2MB
-
Filesize
3.2MB
-
Filesize
28KB
-
Filesize
28KB