Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26/03/2024, 22:01
General
-
Target
a114e0e03c47c4454ae6ba29cd7c4f75fab7c570f8c68b606b1d3e5c3e126f15.dll
-
Size
792KB
-
MD5
f0c81fc68f26ad2a4feddcef90a4c72a
-
SHA1
bee31aa6f4f439691ec630bff371492deb96db01
-
SHA256
a114e0e03c47c4454ae6ba29cd7c4f75fab7c570f8c68b606b1d3e5c3e126f15
-
SHA512
430bb5329eafaf4c414df4637d319b08fcccb43a2015d8888b96d140620b0716dac145283e57e62753cfe1ce9e4210a33bdf77d27664edff3df2821da608ff6f
-
SSDEEP
12288:EBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:g/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a114e0e03c47c4454ae6ba29cd7c4f75fab7c570f8c68b606b1d3e5c3e126f15.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\kQJ\CustomShellHost.exeC:\Users\Admin\AppData\Local\kQJ\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\PLAp\Narrator.exeC:\Users\Admin\AppData\Local\PLAp\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\UZFyqSD\cmstp.exeC:\Users\Admin\AppData\Local\UZFyqSD\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\llmfoQ\bdechangepin.exeC:\Users\Admin\AppData\Local\llmfoQ\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
796KB
MD545218e5a35a045f5ac0835f7f650a9a6
SHA1824eec20f7e6bcccb6a3d280cf6067ab3b436695
SHA256138ff83f9eba2ba6b83eb7dcec1ca734b87897fdbf4920b853782e3fbf0c921c
SHA512284c2da93b7fca02b38ade73c291b39bf2363d06513b92fea57743f91b6acc5ad69d2f3d8190becb602be5556929a4a5524e028dc22fabc974e15efb3e7c2c06
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
796KB
MD5e84ee9f878ca7dbebd83989a9cf89db3
SHA1c4ce360619fc378ecfc3fdf47fb3bf479a849ab7
SHA25620e8e6a3be3fb7e8a48cf7913063ffcd294ddbfece0dfeae992b0f0ab1dfb419
SHA5125709cb7783e2ccc57c1291f76a2332f1e9371e08bc0ae1e0994adb41d548c097997937b7a70b3e8f62e154b9180a2375a5950974c3dcf15eb79161deeac1d5e9
-
Filesize
1.0MB
MD5c5fb93e3cea408e5bc74f32b5377d5ba
SHA1e21bbb5db2e6d4972448864a9e9df2b9f758b1f6
SHA256eada10276f0026d1f42b5e52ab0203c0a9407b1f9ebf740e022f595cbe6abe5d
SHA51261e11a3268d0b1b55e131547f7cf0a1a9fc7bb3e9fa8f4f2a48b819d95c8aeadfea21c7f837aa505cba62cf2a1fa793d9f5739d0c053b943ac58adb8e09dd844
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD50d78f79d4ccdf5edbc55ab6933af475c
SHA1d000a6430fea1d116f01c3f89e50611ab2f2ffdb
SHA2564dd2742f79438e7bf581fb9625942b9c5563e0282985a6e46d24394872e29cec
SHA512ff14f3481a9573f3b41f23b39ce675d4e3ee8afa1422b2122125b5ee778f143a8f7ec4425c3e9bbddf7d07b7033c7dec4b34320fc7980735a22bb83e7361d3b1
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
792KB
-
Filesize
64KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
4KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
64KB
-
Filesize
792KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
28KB