Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27-02-2024 21:52
General
-
Target
aa3f916282e7191e443b2c11431b159a.dll
-
Size
2.1MB
-
MD5
aa3f916282e7191e443b2c11431b159a
-
SHA1
96abbb8c4808d8176b3f9cd15bf97a2f030f3380
-
SHA256
8cdb94adc9b5bafd4c4098348f8b287ccbf9259ad9d5c1d72d4313d00aeeeb00
-
SHA512
18141cc27bc29b6f4c5795ab8e5e0475dedbba5307d1e25cde1ff2e7146040787ff9140a18467b874ff1005695d7ca33d7b0f3869395a3bac1b70ef49443b32a
-
SSDEEP
12288:fVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1dx94:WfP7fWsK5z9A+WGAW+V5SB6Ct4bnbdn
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\aa3f916282e7191e443b2c11431b159a.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\UJIkif7qQ\msra.exeC:\Users\Admin\AppData\Local\UJIkif7qQ\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\Itr3n6WnC\ie4ushowIE.exeC:\Users\Admin\AppData\Local\Itr3n6WnC\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\PpN8GnKdS\WMPDMC.exeC:\Users\Admin\AppData\Local\PpN8GnKdS\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5996bb461bd56820899867dde466b4d9e
SHA1f4a2082b97f0601ec785fa4f1693d737c9048774
SHA25661bb82dea9e7f5e1dc978b53fa8b9a8147698875ed76ff281e56f819c3086510
SHA51246d34892a04047dbe7fc8cf95287419135df1f6e7f5c21c54c849a90637f544a27d01ccad5057449695ef74a831911cd219546a3f81ef10610944e24e9c35d65
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
2.1MB
MD5a9d17dcddfbfed029f8785448bfe784f
SHA115dc3956bc3236131e046c27f1b06c255be5d724
SHA2562d0a66b19f683c3036fcc7c2bb07d176ca5334ad4c0c1c440d85707b7824f6d4
SHA512d65dc9dc9e01992821e82471e8c10c46dc56d0d8c91f54930bd7fcef73307708949c216ba99c87b49940267709df8cf70c08a930262c471cbb525200d5e1639a
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
2.1MB
MD54f7dccfeabd59fce758dc678496b7650
SHA1d451732079d19b76252b2891a423ac308d9f4011
SHA256d165625389fa3d43a62ab596feacea8d578aa6c5f150304f6eaa86bcda4c08c3
SHA512051d3c785ae809174e729f48097bf583772d540b435e4aedb847c9e0e8c519309c15f6dc32e43747c6b27a0322406fb3358fe615df7091b5e9be8c7d930b7819
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
1003B
MD57d0da97116ed32a0732921d151f77cda
SHA1977f3915b9575a9572be28aca41b56d865d4bb32
SHA256c4fec46f0b744c0a551a82261bc529d7a4fe7e39815439aaea957fa5ef03e2aa
SHA512c2c094937eac04855a4d8769c4fb90ef530406c480bd81e393c2941fb90a8eecf8066eca57473af4bf745dab2b401222f18424842a3c6fdf38eedaa355035a8d
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
64KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
4KB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
2.1MB
-
Filesize
28KB
-
Filesize
2.1MB