Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
27-02-2024 21:52
General
-
Target
aa3f916282e7191e443b2c11431b159a.dll
-
Size
2.1MB
-
MD5
aa3f916282e7191e443b2c11431b159a
-
SHA1
96abbb8c4808d8176b3f9cd15bf97a2f030f3380
-
SHA256
8cdb94adc9b5bafd4c4098348f8b287ccbf9259ad9d5c1d72d4313d00aeeeb00
-
SHA512
18141cc27bc29b6f4c5795ab8e5e0475dedbba5307d1e25cde1ff2e7146040787ff9140a18467b874ff1005695d7ca33d7b0f3869395a3bac1b70ef49443b32a
-
SSDEEP
12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1dx94:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnbdn
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa3f916282e7191e443b2c11431b159a.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\LrJVvcMg\mmc.exeC:\Users\Admin\AppData\Local\LrJVvcMg\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\OADmhG\WFS.exeC:\Users\Admin\AppData\Local\OADmhG\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\TUkT07QV\consent.exeC:\Users\Admin\AppData\Local\TUkT07QV\consent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
119KB
MD54b54b3a3593b36af596f576d48b675df
SHA1cb224fb6575b6bd9d91d49728603b6604865cc83
SHA256c59f8c0bc97f47691b1aa3f9404c037c03f86c373d7127734cfc51bdfa6cf364
SHA512578dd072492ae636e077548cd9e4c3e5dfb0498f6ef734447d528ecdbeb24a1f3e06d44c63024629db38df0dfa7ec84325f307ce01fc59774af7159ea260d72b
-
Filesize
93KB
MD54f1ebeac162a3aa9ec39e5e44994008b
SHA1a8601a05d68fe0a97eb13d1108e2d2bf916cc9ec
SHA25659a5712e194f691eabc7e58732a94da84475f04ad691b5bb7444b58a528e52dc
SHA5123036e2799bc5779894a3a8c08b8275a9af1b7bccd4b848d5c575c74ad83a45095e8f78b1fce70ca54804bd06b4b5ccec82d1834870ec54196e0ca8ba88f6045c
-
Filesize
456KB
MD57553f6b61dfc93eedf9848e753979c76
SHA1458ec09519f5073be5179e7df2b1fe458ab4d632
SHA256342af9108025b8495811930e92478b90550a54a94bb7533e41d70c08d61a8ae7
SHA512cb16dc4fe8360cfcd207ccf5fddf3ed261d4c650071ff27c96aaac62e30cdb6f527fb1647a08b540f27d6639330e0b939fa90898f41b9669b4e83abc848efcc2
-
Filesize
112KB
MD5b20593b4ffac10a8cf4462cefa707699
SHA1a2b9f0fcc3a6b5c62e7584753ccb7cfff7577ff7
SHA256af38d1f7966ce138072568631238c56cfc25d17fd0b23f74bb80054c4d8fb6ad
SHA512788052ae2f59ccd4b61681c779c74b1437fe28811ddab03506934cce770ca72cd6c307c0eea8fe4c0d7c40eb9a892e66a3618ac9eef2db4fb25b1d66cb5d3325
-
Filesize
227KB
MD5a505e793b231be1c88d8038c255a6ace
SHA1e500933b21699b7cd55dad898f911363307d12e0
SHA256637a64689e0f29b9a34138c66c4d20e19d8d39bb3caacd19e109c156db6ed979
SHA51277e033193ac0c69b79a3912792d28f7cb7f96dfde4b35d31da85c5a277d7b639f95ae8fb777d1b49c55a06aa6d4a4d89db3b481907e2e51c48db6d2cd46bbdfd
-
Filesize
572KB
MD5711219685b1609f7c07187c95829124e
SHA1bc9a6459cb894d524ba7d8181faf5c9be4feab96
SHA256929e137c72d702eb894c664521eb8c66ee10a32bfe59897bb7068c5cdcf0690d
SHA51244e7d929a0dcbac4fac0d8f72e9793e059c7c841593ed6947c2957b37674eb1b62b9d2959b7af4a18778b743a8cd8db57f990957fd25268154e9802b29c6d430
-
Filesize
263KB
MD53f72fd077f4ecff07f254987d7bb234c
SHA169814fd8a7b803bc7b270718bacffd09137f8769
SHA25626d6c7721e9a923960d76bdc0a2b1c2fc97c7a3dfc32d5dcdb70a6e533f0f022
SHA512608dabd723456f1fa808457b9be75697171ce13e20e77a095a9aa41892b4ca74738e14a0dd29ada590940c7560654d16bd62a893c72f214af0f3b324599d2f6c
-
Filesize
109KB
MD50b5511674394666e9d221f8681b2c2e6
SHA16e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA256ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
SHA51200d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
-
Filesize
90KB
MD50381d331094aa636dd36f16d85eaf4d4
SHA10ebe787b1caeb03a2296c5c07e3029729bddd89a
SHA256e072db5814034cd649f52381979a9c2757ec5654a5f411c4dc3758cbf6f1a7a5
SHA5126bd0e8a354f067270a60b0940c9079a28b70e373badf0bd0d709e4c99749942f7b4956ebf7b109acf00ef21ff00a3a0f7aecdc400a9e9b62abeebd490dc52c57
-
Filesize
1KB
MD597e7bdaa03ac3f2eb9d92860f8725823
SHA102b75587215a792df8dd7daa92a06a8f1acc391a
SHA256f6db0edab7be9ece9cb66903589c6892a86afb7c9ebe91b777ab7f9d883e084e
SHA512e7ef7322abacbd087783ee6ba521e1f3d3dd3ecd600075a89784da4c61dca1bd0d80b8caead04acd715da5c7f90f9829c6ff96f78239fdaa2cce27c630e1956d
-
Filesize
1.3MB
MD50cf10a28ba191d4847cdd3d6498c3dac
SHA143ce8848cb747a274e577c68823eaca41a71ea4b
SHA256b8242c24cf7577e3f3f101539c776ea4d9f4df06112a4a704e445390ea61e06f
SHA51266b691d096a296af911bbafef5f310b20d976861b908aab257b71fd393d893ff328c69f24d5844ea4e823fa36b3b290a69dbad574c2cc7fde6945a124ddc95a2
-
Filesize
2.1MB
MD576362bff41bf40014fbeeb7f7d2a78b8
SHA1b4bd3573d33411a57691be58d4a58cdfe9be945c
SHA2565e5d86f4477b6851c852cf7b29dba6416f04725ac0f8f1a4f75ce100209cff9b
SHA512533a49c26587aae3293bae2a24ec2af0d3e4a785152f0ab70c467d8c99feb17ebe79554c92da1f92c2c7261f499ee3859fcc3a6682b0365336be4cf5342c3970
-
Filesize
2.1MB
MD572a3dfcaa40d8ff198c0812f4e04fb08
SHA1fd289e490f93138dd7fe12172c9eb815245cc97a
SHA256f49fa7afe49d9b08dfa2bd494b8041fdc9324f9665282cdad3f0597047483252
SHA5126535b1f053f5cec14e65cd5a8b7c8dcdca4c28dc795b929692f5a84679360ee55e77a858536f12d3c3a587c0ecb408cac925eff7357b3461bf3dc66f12d65a9e
-
Filesize
109KB
MD51b8eafb46cb66a05da0e525191bb9f2b
SHA1e89a3b9b0a6457d7ed59e2eb26e54ce597d96baa
SHA256f726987f0f317e0c6c6ec0addfef887118036761ee72b2075856fd60dbe24293
SHA512cef075e8fc058b5cdff87cdcdd257380e15d96882d53c4badebcd01370dbd5f0d4a98dff8d9698fa51afad86c71d2e2c1b3f3af2647c9c14acf3e7f63d0cc301
-
Filesize
101KB
MD5aa864b0184c00405e2ec6cee0d6f02dd
SHA18c4beab04eea7c86e33736f856ae38a93b0ba39b
SHA25635404de2a649b415554995fb81299562384bda718aa39cd7a8a4f6f205fbaa07
SHA512644c62ccc1b388318ba9f34615c1ef27f3bc16ab6c8c07d5f25ba01d6a9258a5ffc2919d9e17271a7c526261d2b24efa16e157c2741321352804d13cf4425174
-
Filesize
92KB
MD5ff523af57db4e942295c1dd686ffb0cd
SHA102ec775db770f1593520af0479df8575407bce69
SHA25659ba8eeb353f22af97546ba3884dc09be645355c066f9b9d45a5abb7c24ff454
SHA512b7d00b10f32c5d81b1fa8e962621941692deb18286d0880119a1f16cc00124e8ef7428f9756cba6b1732b6bb4112a59c25bdf6fc049d83a5d2792b153613b678
-
Filesize
113KB
MD594852f7b862e93c6c691290c24aa898c
SHA1c9cfa8f50495f22ca44ef635fc5c004c2ac4d14a
SHA256cad4e47019af6adc3d9e25fea13c29fec090696032d422a78bd3af928ba54ef4
SHA51241fc3b0ac9bcac82ddb33f7b8996b040b0bc3370cb52ff533e2c868b92c95c4a96a019bf737f35aeba095f90e1b32c5a00bce1f0697847c0f790a1a0817d78f1
-
Filesize
277KB
MD50ab8c5ace73bcc75f9c14f17c78c2870
SHA1d0e8971bfd575a5c181cc80fa8dd9af969e6040a
SHA2560af29a130139ae11d6c1f6db4d03128ae109c94792b27d6e6bc1ee826f7723c2
SHA512d5d481fe3d43f1808876b9eb7a97cfb48ce30cd08b1ee3c0535e485624208605686ae4d1de97ee1984d62e150cf3ea7d0d2b65ac973059b34713413dd6781672
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
28KB