Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
12/02/2024, 11:05
General
-
Target
97013513eec319a4402a818111b261c0.dll
-
Size
1.8MB
-
MD5
97013513eec319a4402a818111b261c0
-
SHA1
fd02ea2d8ff8c99ccaf35124b49c20894e92df82
-
SHA256
a3575f530f130fc338946c0c6c4ac822007a36b4a860671383ce565cb77cbea0
-
SHA512
f6d3924530ddb3dc5e1fbb7c864dbbdc517da5610248bde8f2c8628a135d89ad87654b90bde30cc94fe1e7ad0c31ab8e2556ccc4f9e4cc0684ffe5ab2c540901
-
SSDEEP
12288:BVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1Q:wfP7fWsK5z9A+WGAW+V5SB6Ct4bnbQ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\97013513eec319a4402a818111b261c0.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\TWiq\wusa.exeC:\Users\Admin\AppData\Local\TWiq\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\T8FFC\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\T8FFC\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\Rn0rSkHnb\tabcal.exeC:\Users\Admin\AppData\Local\Rn0rSkHnb\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5e2938e62b7dbcf611719845a0fc2dc4d
SHA178da3489e829cae43b9747fac323967b617249b1
SHA256265ed6490db6fb07c20feb796e335ad4f1022904c92943ddaf67a9bbe622136d
SHA5124510a3cdd844785ef9e34f51922fd841fbe2f868e13eadac59e906e9b066a516340884db60b81866fdd3949a64aa83600596f28efc0d49ff1a59aea50746d587
-
Filesize
1.8MB
MD541febbb0fc131f59b9bfa464ca466639
SHA185e1ca096ffa4ee82fba4f41575f99b99b92a661
SHA256c45e5fd485c98ee98f8af91029ca70fa97a9f14e8bb3eedac00c053da81bb65f
SHA512ad11cc80f2371447bcde839390804ecec548b6eeb2aed3a41fdaa8dea0b514f9ae995bf14a20ae55cb0df0b8d6437d29e056f62099783721866032c0a4880c82
-
Filesize
837KB
MD5b8df6d5e44e4c9c38414ce30a409d50b
SHA1ca752e3cafaf3ba6b8ae1219adb1217ed8d53bbf
SHA2565b31634ee07b7336a7ba7c92fbe9d0a6c2eb61f3340a734ae568f07163ffd6a9
SHA51239cf79a3413f192778d3726be1f062a87a6315f4165ddb811033951859266c3f82ba17cb689934720c3a7a87a8c305933b6be5da95e8f70828e05a8b827f7237
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
1005KB
MD5cfd44de1f4448bd6f46276a093992a62
SHA1ff2abe05db020d757fae7da71e6c9e38707f7683
SHA256885b2ac42930ed0e0ea0f7032c2a0da70c99c6f6cd0aac88f24830d49f657a34
SHA5124c06929048af5c3e9b8a8eb7260d15ed3b519a7111df5e061fa1ed6da6754700091b91da4c321d6f0bd96229fba5590ab4db9a874a8fd3f23fbc94503bd52546
-
Filesize
1KB
MD57892a5208fd08e7ffabaae974fdd77fd
SHA1a1f5dc11996c0e374d8d58efa1575c7a08948674
SHA256f818dc181f21535a3d9fca8ecfe458d6cf175e7969a8dc259a023ca2f9e54ba7
SHA5128348ae1b1f327445a6dfb6a5474f9e948fd16f336b5e8664cd386d2d6ea287eb962257bbfc455dd17d661850560286a2981b4742827733f2768a3be87c956776
-
Filesize
1.8MB
MD5966766a82a65af9bba4c398eea2962e2
SHA167dc080ed4a5896fc581086d3aa550ba3964b6b6
SHA2562ea9c1176af9dd5fc828198112886686a96c389ba22e414cff5c0bc04358d721
SHA512778d2ea765adb849f21e5adebb3bdd5bc659a22c256f5eeb62261941f0f20f0fa12275c0624cc9363ebe6c9b212177c2395754864e2b97ce595a4b2fb973ac64
-
Filesize
77KB
MD598e7911befe83f76777317ce6905666d
SHA12780088dffe1dd1356c5dd5112a9f04afee3ee8d
SHA2563fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1
SHA512fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
453KB
MD569effa06c433c33707b5837d51b81418
SHA1c9988a67181b92275c3ea3e43fda1f9e7f761166
SHA2563887dcf8cadbe43a0f29c3e5d8a03a505e8eb6ca52329327aedd0c13f271d11f
SHA5128a77f2739be908edcecc5555b1a99a7d88429b0c40bcabbfd81a77ce8cdadd783c89909c1407f888d04b2640b7003b8a17cc8401653419578ad7124e9d0cc4c0
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
28KB