Analysis
-
max time kernel
153s -
max time network
129s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/03/2024, 22:01
General
-
Target
aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530.dll
-
Size
796KB
-
MD5
ecf496cfed962afd923d73576633a810
-
SHA1
62f53ef7db3f013f56271d65fb5177f29f215941
-
SHA256
aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530
-
SHA512
65cc989d2f47644d83de43c212ec20a5b68be5d34f679989bd801b893c7f69ff42ca148a93a14eae4023e8d30719b15f331f0b2aaad6584e47f674677b9637bf
-
SSDEEP
12288:MBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdNo:o/nts0Q9K/0ooRQIxAk2wi0N/A
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aed4584863417e6f5b5769e1cfd366ec90e9e8df9e87e3c977212a12a7410530.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe1⤵
-
C:\Users\Admin\AppData\Local\XinptlYS\AdapterTroubleshooter.exeC:\Users\Admin\AppData\Local\XinptlYS\AdapterTroubleshooter.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\quBezSXc7\lpksetup.exeC:\Users\Admin\AppData\Local\quBezSXc7\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\DkpELFqVW\EhStorAuthn.exeC:\Users\Admin\AppData\Local\DkpELFqVW\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
800KB
MD5c81dab69e5fb8d8e5ee3f777e6d0cb38
SHA1f33ad6e4a8aa73557901f2c1e5979e25b4ab9bb2
SHA256cd78699799fae11feba21c449f7488a8b000a110166d6e2b67e34df66b7dfe9e
SHA512d9e0ab2d3a7741b05a4e125906813a426232f7db6b0951f1e38eed5d47d3e4e256c4109e9526c6b0dff5c4ebb0175c707f5e04c079ccfd0ecc104e29d1bef4b4
-
Filesize
800KB
MD52173b4303a0fcd070bbcc08901d6dcfd
SHA17c042c70257d335c75709cc589b02e2fbdb6ef94
SHA256c13ee832d3833e56a75cd646ee769cd33fe4b0584f8d38925f9acdb9996bb1d4
SHA51206d8592ede4d1d213aa5beaf2c15b1d09e0b787b5843796b344edbc3a630079236b5a4860944bbe8959290fdc53d0b692ec98844c7dd4fbbef1f94b534808c9e
-
Filesize
800KB
MD550848610f74fddfcb3c1eda7030c1583
SHA1a923295e1e3714e54116e3088eca0e5164f0b28a
SHA256a372bcf7fc7d64478ea39d86cd10d4c7f1e799dd91c45390de64414cf6aa49af
SHA5124226261de8af463c391115507a912a3f5ddf64d961f449d5adfea60c843eaee6b12d2c22670cb58dac2ceb995c8bf48bd8a23f0087a8d13fd60edd1311693a82
-
Filesize
1KB
MD5c43cdeac856e2f0ac23a4057416c40ec
SHA1dcbb740e4499f867619837efa06020d40c28bc3e
SHA256c316ba012c7f63a9648582129a7e6b3aa061a6f3f014d6e95cd01e5ac378456c
SHA512fffc153eef2abd89698716a97e1f388ad1caa91253500fca998d817935ac95c34d4066d604975162f3be0587787a148f1e072132c540dbd24cca9c82f233f7fe
-
Filesize
137KB
MD53abe95d92c80dc79707d8e168d79a994
SHA164b10c17f602d3f21c84954541e7092bc55bb5ab
SHA2562159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad
SHA51270fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c
-
Filesize
39KB
MD5d4170c9ff5b2f85b0ce0246033d26919
SHA1a76118e8775e16237cf00f2fb79718be0dc84db1
SHA256d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da
SHA5129c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
8KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
4KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
800KB