Analysis
-
max time kernel
150s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17-04-2024 13:28
General
-
Target
86bcfce2dd342e9a1c04cfc65731d40ed1c397a4ec47bd9f5b41771297d81100.dll
-
Size
768KB
-
MD5
bd5cfa593ed87901f8184eaa44c0a8b8
-
SHA1
963a57fb83ca6361624fb057058ea4fb538015dc
-
SHA256
86bcfce2dd342e9a1c04cfc65731d40ed1c397a4ec47bd9f5b41771297d81100
-
SHA512
f6235abb0503db5a7cc7a0f6d2a4682db1491127a4f5700d3f68e15535b838651e1df8a8292643e46febb678e16abe9f36f6990db57db3f58c60ceae186ae489
-
SSDEEP
12288:4lORVEAueQmTmQKO2nMlqVaSEwzH7YxiCyJ86azEZy1f11pNx:8ORVEVNmaDznMlqVNE27dJ8J2inNx
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\86bcfce2dd342e9a1c04cfc65731d40ed1c397a4ec47bd9f5b41771297d81100.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\gQRbmGI\sigverif.exeC:\Users\Admin\AppData\Local\gQRbmGI\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\dkvahgvA\PresentationHost.exeC:\Users\Admin\AppData\Local\dkvahgvA\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\btkoMSOg\psr.exeC:\Users\Admin\AppData\Local\btkoMSOg\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
768KB
MD5fc7e35df2fdc6af4dbb840c4089a0e3a
SHA1191633a031e31909e4119521e9909b026308d099
SHA25610ec05041b289ecb3987cf93ead7eac390ded7cec2ddae16c17231b78cd18306
SHA512ac6373651f4e7fe494904c3b8228791f6f66ab268dcd0c1454116732a4bb39429daab77451cc9a31da6199c902f41eb7ae2ae821ae3d92d8ee717f93aa759c3a
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
768KB
MD5f7bbe30cbed46177e8d7c05a5007388c
SHA1a1b9260702ba825cc3c3facdb7391f0fccdfff79
SHA2560c2a44ed1457b5fe0a551b0657a4d371531364bce8e30e4c116e69af224dc036
SHA512ecb57e06b1d6b0ea70082fd4ed9cd78edea838b9c376b7b8afbab3d39bd0fb4df9f392d7d72232f581c309d8a289071ea89d062c35ec82141e7a01c6d21bd797
-
Filesize
768KB
MD586d385b3a67f3de49681865011e057f0
SHA1186aba5c5e5884b1d3dbd83edcfb6823646b8e71
SHA2568ed2716500d67b954d8ed11d3d64d91197ae2cb888b1df96865cbf252b298f2d
SHA512f5a0c9983ccda7450aba87c1bebcaeeb90905e15ea42adc6fd1245e1934b616a0e231c2d76b959707ddfdef94839b74072d679c46b4cf6ca529fb514353c77aa
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD55a2c3d5ff853ad62af56a05da0238559
SHA1d7bda89ad01f84987af262bded67c5c1e3a52f9b
SHA256cbefbd0d1537147cc1f7a9a232b88e89164e5e9e2a3e36f4c4bcda7519151aea
SHA5127214dc018df2fbf3daf88fa70e89f5b9a235865eee8ce6f9968608b9e77d4d2708a929817d61a432fbd62ea7cfe9a567d809e8d6c190a0629789b276228b07a2
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
64KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB