Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
12/03/2024, 22:34
General
-
Target
c4475b106f900a335b0c2bcbcc307bb3.dll
-
Size
1.6MB
-
MD5
c4475b106f900a335b0c2bcbcc307bb3
-
SHA1
b55ed915945e6e406c84b9c00b3ea8847b15759d
-
SHA256
82a0cf7556d7fccd11408d9992431581bce1bf16e8e2aabc554083541ee1b6d5
-
SHA512
55f4e0b6dcac1c8bd41f1d6576ddff7a6c8c31ac6289a8554f9dbcb97218e1239890de1738f12a1f98a40117ab3950bd4c0523c0113e3adfe8c406039f25156c
-
SSDEEP
12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4475b106f900a335b0c2bcbcc307bb3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\09JuDF7\FXSCOVER.exeC:\Users\Admin\AppData\Local\09JuDF7\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\CtZN8\sigverif.exeC:\Users\Admin\AppData\Local\CtZN8\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\jjY7wkr\BdeUISrv.exeC:\Users\Admin\AppData\Local\jjY7wkr\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD5f933a8e654a10d76289b0ad53fdfa5f6
SHA1debddf290faabd240d320044d2dcd86213e75e1b
SHA256978c73c72ffbaa91754400c17e8dc75a4f7e2e1381cd832b567f86da0e927990
SHA512c21b54f1db78cb65fbde4d93ac6780457d8210a2fdf277165f346a71196bc2ba675d0b5ab2aa19f0b9baf6cef233ab9c987e93c484e60217fa2828d4097a8ebf
-
Filesize
1.6MB
MD5e9531a594e9b329678554c0fb01f6f95
SHA1770e213637afdecbcfb92e7f0403927b7520c7bd
SHA256f3d117779c3c59b668c96ec14f48f5766a5ed4eea9e67fb3678f8743bf9c696c
SHA512fcfe9219af1454580211c6e12305cf90b767e676d2fac76cac0a3028f5e739f699e48c10f8d58a02179aed593ac04cdf96ac90f4c5104beec82271cd2a831d27
-
Filesize
47KB
MD51da6b19be5d4949c868a264bc5e74206
SHA1d5ee86ba03a03ef8c93d93accafe40461084c839
SHA25600330a0e0eb1dbb6ee84997963f8e15c7c15c1df787f1c7f109609d7b31bd35c
SHA5129cee858c55eb0852e5bad53a675a094ae591b46b07afe9fb4224cac32e0be577fe36c1ed3e9f6bda4d4eb0c924a773d00e3181cd97f07e24c6c68c70f2b002c6
-
Filesize
1.6MB
MD52eb3ecc215abbe08c7309292cb926596
SHA1f2826ac8f9c436088378df0fdfe27ba46cd60303
SHA256efd767213cad8eae5e1dbe53825fa649fb2724b1422cffcc508ea0627235a5b8
SHA5128b8ac220502392cfea3c453693fe1feb98b0e680d9bcb7a4615fa45ae9fa7992641aa261c041badeea87891bad885420f701d291dce4871d7699248d476582e8
-
Filesize
1KB
MD5a7f69339344f677cdbdb2deffe4606a0
SHA1d597a9eba41d8210f8fb744f0009e94698f56319
SHA2565e4da2b0992aba9104244832859bf88a0975873ca244475d009e5a95bc78b8d4
SHA512dc3c93804cfa91fc1fb616945c3415a058ec17b6be1555c5a54812cbf24844dbb649b6f6509087089f46578293878354dd50f89a876f60eaa1adf1130b886ac1
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
1.6MB
MD553ecd7e44f66f3f4677777e3a59b5be4
SHA12caa753ffc08dfb7d1f63fd4f245dd9613c95164
SHA2564f76bf6ed056dd4b5c954d99b6b0b4265255ff59b2561cfc7d01ad72bc312bc3
SHA512394af5f84f667b00b8d43e32a5cf783e24e58b08d2c2618fc6c831c291119af4c2cf9dca02e1899a6130e2462ee79169c9bb8955440e1ab061d5bcc7553eaf1f
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB