Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
11/03/2024, 19:57
General
-
Target
29eee3b4500a5c9457694d4fc1a3446fb4258a700b17a7644cc2f889a69b39e5.dll
-
Size
784KB
-
MD5
dbaf5690708350d89f49bca1d793e356
-
SHA1
86318665e723971f0b079e442c40deb76dc5569b
-
SHA256
29eee3b4500a5c9457694d4fc1a3446fb4258a700b17a7644cc2f889a69b39e5
-
SHA512
a7feb14efdf0aa13b497cbe4675564e5e6ca9a9e955cb2ee229356e5da037a8faa0e93d7da4b07fc6dadb8239b2427c429d05a480475fdfa87782d46f5a2df13
-
SSDEEP
12288:QBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:8/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29eee3b4500a5c9457694d4fc1a3446fb4258a700b17a7644cc2f889a69b39e5.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RDVGHelper.exeC:\Windows\system32\RDVGHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\OIBIF5R\RDVGHelper.exeC:\Users\Admin\AppData\Local\OIBIF5R\RDVGHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\DvL\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\DvL\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\AYy2Cdx\wusa.exeC:\Users\Admin\AppData\Local\AYy2Cdx\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD575e1c2d95e426bece7bce279814de342
SHA10ae8b2c85c5edb5ed11df4656c010a32f9bed3a1
SHA256e3828f4fafe9ca5d1a291890a3939940cfe286577f1b987435381c7c51782b59
SHA51284fd98289a68d0f975f5d22590a9f64cb05f845d1f8e081900d1028d5b1a97ea613906a22bd09e906851f9047b3e0b73be1a16ff36bcec942ce465b70be155f6
-
Filesize
788KB
MD508f982e5a872b7eca51d37b209ee4996
SHA185a50298fa7482e035ecc48301e117ed6728cb09
SHA2566af84cfb6907699acd8e8962061efe2d8131c2267e1faefb5e2de994bad0ab85
SHA51228b897f2d2adc9e8b557e1f512f673a0631d4496acd3a8181cf3547d95157273cce43c63a37d831573b9a350354bd503b61f1a67a4f9a78260cbd65c5becdaee
-
Filesize
93KB
MD553fda4af81e7c4895357a50e848b7cfe
SHA101fb2d0210f1c47aaf684e31a9fb78f89bba9c0f
SHA25662ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038
SHA512dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051
-
Filesize
788KB
MD51f165c02c1429f8918fcd68407ec132a
SHA14c40d0e850f355c27f0354d525984977ed8cc24f
SHA256d5d69f3bcb1722d965d28681c860937399537d79546780258c5376320a16687f
SHA512b3c3bfe6c08948c9d5630448cf2caab0437c8ec5a0bb40eb2b981adba6b035f956d9ad4c995baec89c5953b2a95fe06e9ade982f088706287bd75e749fbc7084
-
Filesize
1KB
MD5c61c97d17b9ecb33931dc8cd0c90fcdf
SHA1e16ee00f775f4fc418db7ebcf58081963d3698eb
SHA256763473608d4738cf9b20cf80330580b980b6e5785699707a523b878bd3642187
SHA5124c59ec70110cffe5a9da74bee52908ec1cac512100f82991aca87cda8e090eebd8459154a6a6db4e7bc067de3743395a45b9b46b0958dd29bb8135b0dee0fc74
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
788KB
-
Filesize
28KB