Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 09:53
General
-
Target
a192b8c5ee93ba20952ed6145cffed29.dll
-
Size
2.0MB
-
MD5
a192b8c5ee93ba20952ed6145cffed29
-
SHA1
b2ca4c66e8e4aab00168a1a9d674c2a511e01084
-
SHA256
74a366103bafcb5151e3296c9aa9e75179e8e7b3f7bc0e9995e94e4f24ac9969
-
SHA512
74c4575331b38c35a707af51d631d561cdcddcbd44d29524bdece5d61b93679e393648502c1727c645b3209070ced2c3b525a7a5c5d00f3b40c698f4a66f6597
-
SSDEEP
12288:RVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1ad:gfP7fWsK5z9A+WGAW+V5SB6Ct4bnbad
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a192b8c5ee93ba20952ed6145cffed29.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\78DC\rdpclip.exeC:\Users\Admin\AppData\Local\78DC\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\bgBNsgF\DisplaySwitch.exeC:\Users\Admin\AppData\Local\bgBNsgF\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\bwD\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\bwD\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD5849702d805cfdb65c4dd70bc75af6ef4
SHA19c85549d5728815c4571cd0a85d35902f860d800
SHA25689bac729433873e2d9ff623eb8981705220bcc5c615041c0df20e17e6905e8ea
SHA512e869487cc7dabf0b50db83065efa24b33e23d0b7f01f369848ddc7d1be7655a912e81ecb53e7883ef7fb47d555c6a7b966b5d559989937ab95f8592d56311e28
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
2.0MB
MD563e03b94bc31f161ec3af6951d64a032
SHA14217c8d8fa4f49c9387c0dee25bac1a497ef191e
SHA2568fddfafc3d2fc33c2248ff67166393e1402be628cbf967e565c13171d86668b1
SHA512e964ae39921f3237ba325d84f6d905e8e11277210d1441528be7dfe48471651043c1985cb8afdd9e1fa695dc5e73c2b2fcdaf6912236cb247e894189a2eb1345
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
960KB
MD52a791ead40639c6936f956f1845c3a3f
SHA1e037a9e739a27e3fd6fed5d9a5777426e9971af0
SHA25697ca2c314e32d34f38914b5de7c3e4824c4edf1276c6964acebd6fcbc272ce64
SHA5128f3918e7aa79a8ea1d7586c72402d57a19c58b9e3493f55edf29d935bdcada5360185eeb4ecf96f272ca062808b7c8ce7d92036da9921e3dbcb3afb908aec44e
-
Filesize
1024KB
MD56203994c979925ddabace7a213b00cdd
SHA16f94829d6857e8b7ceb7d9beb51ddb3896773b9c
SHA256744e2e61e3ced9f63de4c44b21f317ecc0ff937876e45ba1033f775ef58b3af9
SHA5123a59d7991ece90beb6cb1da47849d04aaf4997560532cd000abd8a9195752f2b4006a48e9219e49fdda78f0fe90318df7f380a6f909582e02d3e45d09bee6726
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1KB
MD5f3a66381932b6cce9d0f15d723d90ee2
SHA1b832312cb998b60dedce05e0ee78a3ccd322c2c7
SHA256b987a8cde54ba9d106b8ec6488f34220907be4c4c89986118e08ddd1bf7637d6
SHA512d4b2f0c67ba94dc7545be73aa83276aa7b18ed19b179e349a1ae2669ccc3542fc61bc96b233c7c79ba6e4007f8e2a0fde786e692eb75d6760342dc5c8b6086cb
-
Filesize
2.3MB
MD58b421354242763f11064a19dd3b42451
SHA1964b13414fc61f78e4990a788f8263afbfdd332d
SHA25666a00dc484b2b2974feef6d2517d1dbf2a85909d67319dd7fc74d5abd2a6a4e7
SHA5123a11671ae57f1b42372379f4bb74bd666d472a6a8f10118731ba0f15d488ca2d8e517903caa2024fd034c21b0e8514912518342d8c93ab5de043ffa6ae011bc3
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
28KB