Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 22:34
General
-
Target
c4475b106f900a335b0c2bcbcc307bb3.dll
-
Size
1.6MB
-
MD5
c4475b106f900a335b0c2bcbcc307bb3
-
SHA1
b55ed915945e6e406c84b9c00b3ea8847b15759d
-
SHA256
82a0cf7556d7fccd11408d9992431581bce1bf16e8e2aabc554083541ee1b6d5
-
SHA512
55f4e0b6dcac1c8bd41f1d6576ddff7a6c8c31ac6289a8554f9dbcb97218e1239890de1738f12a1f98a40117ab3950bd4c0523c0113e3adfe8c406039f25156c
-
SSDEEP
12288:KVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:XfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c4475b106f900a335b0c2bcbcc307bb3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\jQH9tzj\BdeUISrv.exeC:\Users\Admin\AppData\Local\jQH9tzj\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\9K5IgHX5\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\9K5IgHX5\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\NGvY3XfIf\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\NGvY3XfIf\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD563d5e9f5cd78e8375aba8dff9bff9c9e
SHA10aab6012e43b4f04120cadab71ca3f94815e7531
SHA256308b05bbcd33030cbb74989f2cef3f478f55f77525b52e55a2808881715338df
SHA512501bac40f897b7678f34c923d0f529742266ffd724ad676fd383e033fc5adeebc81276003ea0b5130cb0ead70292a8eea68c03d8ae57f34b480bab6264ae9ee5
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1.6MB
MD5eb5e02c66f360151a06c303b94a97df9
SHA15af481f1d37bb68fb5146a7714d5506d273f3f3d
SHA256c779738d54a277e5c6494f2268abaa88bde7e168e8e46d35dc0a8039e28a7c22
SHA512c6f1a38985aa06fdd1b6575ce7b1f7f3605e8fef380f1a4554a2102e9b94a318bdd724f79613c8721cef107429dda6e8c0909f2351652ada557aa492d876ec8c
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.6MB
MD51072db33e713e9bc1afe229952b46b57
SHA150cf9d2724706983c9ce77d8389337f8da5c849d
SHA2560fc04723d34486870c0f9903dd75291cca2ad2b34b872fb8dc88e32cc7e51572
SHA512183ef32b9d63abd66f084ebbb026f0740ce536d4d3ffc08c2614af1aeb29797f0aff0fcad8419a139a52b518f3e194bdca6b9a20bb4bba08ee007a0d52f865f5
-
Filesize
1KB
MD5202b03cb3d0bede2b917570927ff277f
SHA14775b12b220e3c2acea6515925ce2ed260fe9384
SHA25633c69b3479d2d7b407eff7c4cc7c66bbed3b3ef6dc3bc1d483e34d832ad532e4
SHA5128e35a01fc30f71bcb4cffd13651cf8923e8839c319341204e2f15fb11518725bf9d64e30f04c08500350264857c2ebd0edbd77942fd6f2205b29a19f00296365
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
64KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
4KB
-
Filesize
1.6MB
-
Filesize
4KB