Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 06:49
General
-
Target
75c4e5ea34c5b7bce8151ef2a04337e6c6657acec991fff8b3a6a9f23e216903.dll
-
Size
800KB
-
MD5
5df0b4b0381cc82c174e4175011a5904
-
SHA1
767c88a86cacfa66aa8f8715225adc9156624bf8
-
SHA256
75c4e5ea34c5b7bce8151ef2a04337e6c6657acec991fff8b3a6a9f23e216903
-
SHA512
e679183963c66596592670ee8c210a068c8aca15bfb8e2607c066a6da8b4c455f5ec885a2b36c17e4e2d858cf175aa13eea797884692bd686b599ac6005396c4
-
SSDEEP
12288:hBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:j/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\75c4e5ea34c5b7bce8151ef2a04337e6c6657acec991fff8b3a6a9f23e216903.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\LY8n\rdpinit.exeC:\Users\Admin\AppData\Local\LY8n\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\B9Bzpkhj\mspaint.exeC:\Users\Admin\AppData\Local\B9Bzpkhj\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\lClq1xGL\bdechangepin.exeC:\Users\Admin\AppData\Local\lClq1xGL\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
828KB
MD5eff03e10688be76ff28d868f485f448d
SHA1ef63c007bccc0bd9b017c84fb202c4e90ec63752
SHA2563a35825260b13a2c046084110cfd00bd4adaedc2196dbc07c9051147f23e2c20
SHA5121954f1bcecbd068e6b41ce1492a0f9109e24893c8027227d7a047d1add0f79c91f7cf46220a9e7b9cf11eacd1625536d1ba814ec5627a82c955b4bfc98c1c4e8
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
804KB
MD5f4ae931d7f00095754cb5875d6a0cab6
SHA1857556bf6330c86bdc674ca4348d77d35421300b
SHA2562a3fb3184e0737ea7f636297b5fcb8e46e9b48a7a3ad49c8d017833e252c311f
SHA51259952dd317ce0a37917ef05401f0859ad10f2f75ab38df2e0ff84554b71587c211a02522580b13b09b5afd4c55ff9d98c428eec0e5656ba788ce213968846b4c
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
1.1MB
MD56cba2b8041157683cd9e4010356d77f7
SHA136a99273ead08e7d4b68e8e487e783ed9b1d1ab3
SHA256404f65fe8a5c9d579f743aec49f4046bfdbd0861a38605d1abf15ea98f5fdeb0
SHA5128d479798e2112b34546f457ccfb57eb1c1006a8815266f1a7ca46a3ceecc9356e593a12de850e8310260379f95e059fca8dedaafd87e69de6532319d05e611ab
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD5a7d01e35c4fa52a5491290f0d8d2148c
SHA116c0191fcc6ed92fc4a57f5e39c467dc9295d4f6
SHA2567a6d3eadcdd85446d73fcff3dee4c8164be1f10735bd2b4462a3d8337c58b260
SHA512add315a0c23bd647c7eb55fcc07e942a390b0c37e219d027e4d42855533bf027252751f1ffe0e3fb2d13833d0678844bcc73dfc300292c66e6db75e959a6d17b
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB