Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17-07-2024 06:49
General
-
Target
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll
-
Size
800KB
-
MD5
844f37f59e5af38fca800fb75c94a4b9
-
SHA1
8505caf8264a9a1cdd9a6f6cba608ef01e38a2d9
-
SHA256
db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c
-
SHA512
7c3130224a823be7271e9489497c979bae68836c3779f0028325a245ff2138ef21870c4d84fb1d7f8943a1bc1f497a2d63d95aeb8bb6a6893ad00fc4d4f55b7d
-
SSDEEP
12288:hBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:j/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db9c18d05fd830f2f9e7cc0b5011f44a80277b3e298cee715587e8607542b49c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\tn5hoAx9\eudcedit.exeC:\Users\Admin\AppData\Local\tn5hoAx9\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\IrXwPnBLy\msra.exeC:\Users\Admin\AppData\Local\IrXwPnBLy\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\KkonnwMWp\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\KkonnwMWp\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
MD5e4cf72607890fd63a9930a95813340ef
SHA15a2808e2162f22a4b2d3cf674cd4247bbd85886f
SHA2568dadd487ae3774ea5b37601106862a04364e80e19fe114e6209d176c6425af96
SHA5122965b149d94477cc8a92ddaa54ddca9b3be18810540e21a829701df26e849bd48c2b7693370e135a190726cfa3ce3ac09c4c2725e60818084d32546eaaf04025
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.1MB
MD53660cbd919b5a43136d16548b63d26eb
SHA1eccb205871d994919a1c493d5dab494ee2cc56e9
SHA256b224631b0420fe65eeecfbd161189a4de6f2d6dcf9be3470c2c80332363f25bf
SHA5125c0a2053081f6f629d202be2a884dbb8fe122198f8efa0e14d021a7ee529c432ce500d962d1a244b3464369f260ccde7c010f8e37ba4e769d6f806de4cff5e80
-
Filesize
828KB
MD561f2ba6f90d30971d6b4fe4013576390
SHA190a6ca593c47b84d31025a38dc48eb744132082e
SHA256b23574e0f5b911b4dee61f2f74d2416078f13597948433ddc807350c49c1bada
SHA51294b8af5b39ad63e24200d251bc342ae8cb0680d42a652ea5372b6bf4da5cb241693c5d00bb4ba91352323ae024dbf5342cff89d7ccbfdb97132510fd71a79da5
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
1KB
MD5e1ddb307a33f98d3c896bb8ccf3172b7
SHA11572cc73653cb550e2d7aba6e5eee4ae5d13e63a
SHA256f5f296a522cc6d9bd8c2c58c7953fcf9c8f0644c6b410d484e2338a0124cc73b
SHA51261c45f00b00a85c2b777cca8f76538cac2ebb973087a970e3a51bb3ba89c0c3b447c5c8fa209427ed02309bbf4269f309eea9433458f780520a1a76a22453ceb
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
804KB