Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 03:36
General
-
Target
7c0b7776d8e7e775fb646f2bf3c91c46.dll
-
Size
1.8MB
-
MD5
7c0b7776d8e7e775fb646f2bf3c91c46
-
SHA1
716d6d1caf34896aa69120fc3f08e7f480e3176e
-
SHA256
6e2ba94de342be1b5ed71468cb2628106a823c38419cbb3fc6f612465523853b
-
SHA512
874c1bf7a350dd8a81d00b9edfa95efd5c1f58b3b185fe99f8e58e4f3929b7646509c75b5524c49b7c6a679ea4be003471de69f236ea24c18dd192fa5fa50f5b
-
SSDEEP
12288:iVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:/fP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c0b7776d8e7e775fb646f2bf3c91c46.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Br0Ir\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\Br0Ir\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\mOzU881s\unregmp2.exeC:\Users\Admin\AppData\Local\mOzU881s\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\eivoq6h\osk.exeC:\Users\Admin\AppData\Local\eivoq6h\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
77KB
MD575b461a9f3af80e9e9bb2a813a74c6d6
SHA1dbaa791cff9c1c84a54997f3f51a4d7e8d0b0bca
SHA256717aded95a6154f66c1e93a592023422c6d72279e555afa328f5362215f51941
SHA5127be3af8cdbe42b42a574c781782bb4dbdfa16ebf3340a823050f7946fee9d7ea4df6047b6fb6453e4a0eee75927539d1db74509bd74033503582609a1e15477f
-
Filesize
42KB
MD537fa7da4810c10f5940564ccf5fdfdbc
SHA1b6ac471b0670f87fd8578058e883a31135913a68
SHA2569e05ddd9044df09a49082ed9fd01cf7429bb692a58a683dfcba63724f06cdd03
SHA5128fb8314bc2854aaaa0a5355b84840a61b4a725ab6aeb603630df25b8cd27e1cf3f7370ef599b845b5e8356182c259c6c7e1769b60a76caf95f4a4c599fe8b640
-
Filesize
64KB
MD5116309b2d3057eb5f87fc4a85aaa51db
SHA19d4f18a8b693e607e296c30cf9912c81b06ee586
SHA25621b6d6fb58972dc05623ea606bc0533d7db3cdee2617446ae5468e5b944ceacc
SHA512530ca913aaeef8f4c7a8dccea966e229bb15c65c8e809e3d4eed75ef4661d80b5c5e7ceef6099f393cc79f0c20050cea50bb80e045ad1038d569cdac157c2687
-
Filesize
254KB
MD51bc43672b3459c229aa2e7912a46a5ae
SHA12bd87532355190d3daed7d11e81eec25ac726e26
SHA2568ac3f9b9f46f58630647fa8a6fd0dea1298b737edbd5dc415f8550581ac765a1
SHA5126cc989428cd12c18e9b898f47d8f7dc1f65dd501ab2462bb2a4b84745965ac7ea3375478b03373e65d75b928b87e1b11ffb322175df7c632767eab90dbc0fdb6
-
Filesize
49KB
MD59ebbb090e274558004a628467ac6829e
SHA16912d669a25a9d1c5ad1e45cdb4d5359fcf82cd3
SHA2567973f8f27c13a5b18841cb9a5ee5ec00c09ac47a7f47d2787268126e002c54ad
SHA51205b9458f14bc77602586a69164288c2dd40aed6937aea53f895a15c764aec86cff9f545dae618fe2d5fd84adc21cb9157c3bca12fc01f24910770155c81aaeae
-
Filesize
38KB
MD5c4441d3cb133ddfb35b1f0be187be9aa
SHA14fc63540806d93be1ca70587a17ec7091877e9db
SHA256710c4f7984f78e7af0bea6193193483b3aa1a963174d154b5ca3da69bb243dcb
SHA51257da2a5f58f5793d1a0cd0634b40b820a8e1c4fbe0379f75a56f20978343c601cbc7cc2f649ee841a24426f972e4d5c2525c4caca0d4ce8338f2fb260f15ffc2
-
Filesize
1KB
MD5a0c3afb4c22a779a54bb07eaad989fc6
SHA12a373e462226635beb5078acfec8460968e04cc8
SHA25670aa4b43a770d3339ebf444b82daca28c875a7cb432f3bb37a79a834fac86cff
SHA5129e2fd9e548dec8499113547cdcdde7b8e25ae7fcf3272918fc9fb1ea8c1cfde9c5798aef8f1ae627f429f6c9fb5e72062697e25d69a8330c7c5071c2b74caa4c
-
Filesize
1KB
MD5fc25e5af88252293ccefbc61e065ba5f
SHA1e598ec93f597d2337c53d3d8a712f48cd4d9d291
SHA2561c88b47094b366e8597f5776fb59a9820ee853c596071616b855835b5b47f31c
SHA512a1c6543ebe3c0bf4c5ab9c1d177a5dab2903372ce5bb191bddde57a099bcd96afbe3aaee47cb522fa38221222a2e642e02f9d922ca441d791ea3f639196469d0
-
Filesize
1KB
MD560dd1aa885393ea7cb7d058951f921f2
SHA1125567b1f3970fa93a55fea6bb027ae9f80f5d6f
SHA256625c739a61eac29e48b95eded3ad7614418fda1c00e87e8d1d953ebed16a0867
SHA512d61e421869898df6036cb4805087bacb490d78c318a855814517402e11b12468dceda828fa2bd995e599eabfbc7464df62a7d9bca55ba050380639a693e20d8b
-
Filesize
1.8MB
MD5130fde09bb8e2fa3449dc0ea08f93eee
SHA188258ca50d9080b0a223ba437b6d5dca1f38f6db
SHA256e3d3a199ddc4e17ca0327b8985dce74078d3714892b888fcd6672818edc98a7c
SHA51213dbd06feda0f1424bc87a351198c5e48c00c3adcf3d9d944b8c0d5c91fe7b3d3e10d7045296c4d4b788ec15904bb09e8fb6775d2840148b67710cde2d692c50
-
Filesize
1.8MB
MD531cbfb419d45a55b51b3bc4341ca1cbb
SHA10bc84059d3637468774bc6765900cb0b1b995c52
SHA2567be7a1fa881efc6c9f24bc800c37ab0018836d986625b5478b613a5eb6e7f559
SHA512f72f73043aaa32ef16508abd0c258f86ace5400c2d320ef3ae5e80b26b34a1556da27dbdde093c1695aaedd6ca611f35ded760d2fc405763a5c3082a1c9ef6ab
-
Filesize
1.8MB
MD548488d6df62d162c9c6de917807207cc
SHA1c5b01a5d30c04be29fa047536f8591cfdd5a3a97
SHA256b364e12a918f82e2ac8c20bba2ae76cec350f777f0bc1b5ad849dfb3d781536e
SHA5126fd9a7fd9585a192de9753c4d334a95e810ccab4e231dbf136c3f44a89678d7c12d1fe2c18ea40d65f1600cd1e21e9fc118b4476221f4ef90ce5358a4f8a45a8
-
Filesize
104KB
MD5444a96a1e3459b278e9e68814e9582df
SHA152cca8c4f69b253e3b35d0ed977dcfb06a83fd22
SHA256fc64041f6d9f703ff981d77677d3010ed4ed4ba5d2477c0110f050897a07c435
SHA51284b10b41ca2997a549382c5469c1b4a4ac3ebe7bbc0c06089ddfe57e2580bfe7597e01333641dbb970e50309bb3f38ac8700463727860a2024030cd9602aa14d
-
Filesize
43KB
MD545f90408b91d3ad51f833969944f4a9c
SHA105f4a31c17ff91aa13385454c7206889eef7c31f
SHA25629ce6f9219d5fad505e2f032e4bec4a03968e1d0793ad2b19391e21a4a7e543d
SHA5126a8944c1c67b874fcc538c7fd05e90877f629f1f04e3e61810913c0a8aaccd1bac5a8cfcc58ae09bed8b6ec0c41ec36b5d5a9f6826d2616f9ff5ec15de460344
-
Filesize
122KB
MD59a8a38f5e4cc9a1a18b74d5c183cee84
SHA14fd8fdd3fa7fcc5a891cfb1dac2fc1fa84c6e79a
SHA256e55a4b6f68759d4d6f2ec2f9e8cb431ebf0f789bdd2b055e3b1374fc6bc09be1
SHA512ec92ec336bd4887e8fcaecc01d78e6a52066f671a848797b6f3c2f4ba9245266a16949ddeb2da8b51dee378d769f7897230579c51758ca8c9066a3bec908b7dd
-
Filesize
8KB
MD5da39d6556bc0c1e94e793743297ef02d
SHA14927986cae0f07715ee14b76c973969ee1777d9f
SHA2562a4a2c39fb527095835427a02b52cce8f433e8479b8b1306c7e3989d2d4c90c0
SHA512a1c94acf63ecb432f66ebd69cc88ce1c580c12b4320167f19e017f556c7a680b8df555f5bbecdc3c2a7564bcfab27dcefec87701a0ff887a5a68c5b9aa9e08a2
-
Filesize
18KB
MD559a73b4f1869e38996cf4f67b8986833
SHA1aad59f2bd204f2e958b340dd8b8d2c04d9a91f51
SHA256ddc528a7bc1065b5f09774be1ffd72320df2821440ef746e96468ef6a5b43185
SHA51292de5db32c9d6006359282ab8193846d1625d1ecce1c583fcad52d6fa6834f610a206e5ee75718078655dd1a475b17e837cc85b0252b8b6e82cd35dae875b55e
-
Filesize
54KB
MD559b2ae056c8e8b18a1026f60010a13ff
SHA1bfb1fa267f389316a4449dfca684d7adcd541b5a
SHA256e78e644b7c05376b3c43ae352aafb24883aefdfc8170eb4acc88d5af08219632
SHA5127c08798720f96fc74e3e14d9253fb0025ad45c01cba7fe8e28af809c35d4b5cb97c262eb055f2d5fe1cd42c62ab527593d938f169205d8477010e9143386c02b
-
Filesize
93KB
MD598a9be6237792bda26f6d26de3d8f278
SHA18fdd1941b3da2a2e4eceda5e42198e9d738ac6ad
SHA2568497de5d8fce79d15614872e421fa77839b5d9791c8157c8473180d6bb01fd5f
SHA5128228fd0b07ecfc88231cc94de21799c886826091eae0d4cb811b60a2c1d4b4d05fc8d7566f4f73a41655b8efc94442044c3ef28c060d5da3731d27bcc75ca435
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
28KB