Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
14/03/2024, 23:21
General
-
Target
c9e410101585f3d589b601831c9d51ad.dll
-
Size
1.4MB
-
MD5
c9e410101585f3d589b601831c9d51ad
-
SHA1
bbbb4c0a677d6621e43b0bddca7b51249d7b6bb4
-
SHA256
44b1f722fbb4844f2ac3cd62429abbb980d3c9965e92b670cef7b59e7ec18c2e
-
SHA512
60c52fc35ef42abaaa49fe6c9e0310b5037109b723a0584d97b28ea03114f56e9e96b3180a90a4a832d38534a8002888c153d75f9f1977439213618320c7438e
-
SSDEEP
12288:bVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1U:6fP7fWsK5z9A+WGAW+V5SB6Ct4bnbU
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c9e410101585f3d589b601831c9d51ad.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\1bC09y\msdtc.exeC:\Users\Admin\AppData\Local\1bC09y\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\XWv5jxFe\ddodiag.exeC:\Users\Admin\AppData\Local\XWv5jxFe\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\znDRYv\mblctr.exeC:\Users\Admin\AppData\Local\znDRYv\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD544042a326916c9ed18e7f91d315a1968
SHA18707433b2fac3e89631a9878e523560e990ae43c
SHA25606db8865f0ec1d904472e880e798555e63f619ab5bf6af990995bfab40352420
SHA512a014922538733e707ea2b0ee3bd1275dd712ee1e7e2e6b3bf5a82d5a928d536e3fbc0f459ec20cfc14dac94ce6c5db6c12c17ee76081abe38975d18498e38000
-
Filesize
1.4MB
MD5322e4ece8fcda5f06c61d21da8439652
SHA1bcb1cb3d992dfa61d557e167a7b005df73fac7fd
SHA256c25bf7b776fbe7626b265265f11856fbf94b8fc69d6c9abb08dee712da92ea74
SHA512d82c35bed86f5c887e7728e0da421ddd2105c0b32e4249821ea08a0d79876fdd69ad5d437a70210647d8158301fb2d7e84a9bffbe8506c0e601e2d3ede48f7c9
-
Filesize
1.4MB
MD5ccf0f804e5724453a557b9cb68fa7f6a
SHA17ca7090bf9ef4aaec1db49dac0726fcf1ea693ea
SHA2566dc6013d8e49b69f97348e9a85fc5a578b46bcefa02ad2d912076484269cb0ef
SHA5126a69ba57af412714a882652166c2540668e75aed098b42680524052f6fabf1405c2ce20caa05f8920612e08fccff888f803c7d2f2510e616cf0ceeda24b13c88
-
Filesize
1KB
MD547af3fcc272a8352465b3c5477b0ffcc
SHA1be9574797d1fdee6d943edfa5354a7b9df2fd7f2
SHA25689c98179a574d96c48eba1ae3984222ff5c96591f6b7b2f5f3f6b7d25b523034
SHA5121b780d4660b26e0d784c6e2639fe3683ca2e3a7f3063aee097ad500b99601fe206ae4e63beb98302e9042cca6ee721e961481d41f5a048987035d290d50b005f
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB