Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
05-03-2024 19:37
General
-
Target
b58179d2876272ed58a6e2d6c328be3c.dll
-
Size
848KB
-
MD5
b58179d2876272ed58a6e2d6c328be3c
-
SHA1
2d8a3a857491b3523f93b08e0611e741925be9ac
-
SHA256
548a21178bd299e07a0b0bb0957decd17f937a37b8fe4fbc8125e360bb1f0679
-
SHA512
ea4162f81987df295e7c1a568dc98ad440b34d2d17eaffa74250513199b33d873279a6b4af2c1df8805f61afadbc20c508b4bce3b7d6fcca239e89ac4dda24cc
-
SSDEEP
12288:4kbQEkWqv+157EYfxarhwLNuR7ek1tHffB/HzTyNQ6NIeGYr/R:4kbHkWfzZ5adwLNGeStHntqN7v
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b58179d2876272ed58a6e2d6c328be3c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\1Lt0h\MusNotificationUx.exeC:\Users\Admin\AppData\Local\1Lt0h\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\hMbzi3\wextract.exeC:\Users\Admin\AppData\Local\hMbzi3\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\udgAo80Gf\usocoreworker.exeC:\Users\Admin\AppData\Local\udgAo80Gf\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
852KB
MD5751b3a8d62c9e56a2d10fb51d360de97
SHA113cae12c6ac56fea3b71be9c2ef23b9f7e826491
SHA256aa5f364def45176f0f0ca8af9c7fd29dea38e5f92083362237f3edee13c7031a
SHA51244697e0530338159587ab0a43ea795d68e07b1924376a647eee4f3a474e48e387c2f10b9b74dae960f5f5b7df6c943b0b773463b3df1c0e6d51a5545e143dfde
-
Filesize
852KB
MD50fa1e3ed59d83977015efbb3b5a27b04
SHA1d1bf71407d7f12899461fee0fe24d1dc0036bbbc
SHA256e9da036d8eb9d1b180686ecf164c2af7cd6ab3bf5de9dc24f699928cf9b51f82
SHA512a87b7c369cace6e5c12f2b80cbc8006443e71081ea8846367a34b7ed5b836b9d1a680a41e185c322f23599e862204a52e988e22abb2aa566d7747793485a3b0a
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
852KB
MD51cc81d305bd8a9b93b39e5ea73acbafb
SHA1eae79cd890e84c9e2f56a9aae9916c5a2a0b3483
SHA25688f1c7df4843cb0e14a4b2330475c8dd4563c14ffe3a85ec8c142f602f9591f8
SHA5123019d103ac679a334360218e4e845962436b55557207da69d40b644bd651f6ad2b8d7306e5bddd086cd96c7a18f8017369e5f42c77db1ff742474c2284049d30
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1KB
MD560a6c1f038e308c8d01c9947f9d264f6
SHA17cd5d03dfee32fa2d08e92b863d6869f784fc105
SHA2562f47fd71f3693ce4dc33642d4111027f14abfe47cfb5e2bc6544c868be3e4e9d
SHA51287813dcaf3d12f2ccf979cb6683c04cb10211273a139bea45beb6fe43c4f03e611bb633aab8dc200f219d56ae649750cefd88f5ea226d5f8bac5b3441cadd1bb
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
28KB
-
Filesize
852KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
28KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
848KB
-
Filesize
4KB
-
Filesize
848KB
-
Filesize
4KB