Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
17/07/2024, 19:49
General
-
Target
e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll
-
Size
800KB
-
MD5
252395046102ed9612e50d71bdc56fe5
-
SHA1
23b893ede7e9473b4fdae8051d935ca08593c958
-
SHA256
e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66
-
SHA512
a5cde48eff1e96551d66cae42d8cc88c58efd71bf3ce9da18bdd77c82b285d643c11ffbe55631d22c6e9ecaaa0c45053d74ba46254766c983563704d5d4ba12e
-
SSDEEP
12288:zBim9Tnts08FbKuPcA8NAc1l/XkGaZKoRQIpRX2/0Ak2ng/Zi66wNdufAdN:t/nts0Q9K/0ooRQIxAk2wi0N/
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e2de0d401a8809be7f287cdb30e3151282c0de21c5bcb7b41437e8fdd6b38f66.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\66RbyD\dpapimig.exeC:\Users\Admin\AppData\Local\66RbyD\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\W3yRC\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exeC:\Users\Admin\AppData\Local\MnGptzjL9\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5dce004fa7f5c7165f9e31d4637e4604b
SHA1a09035d0d3148112fdaf0fd7f3b9b7832abe3c86
SHA256d545e8d81b4161f91b01cfcdfced0de65bc7b64529aa542639f979e1fec89e14
SHA512c73fa228c2a58df50d85242db2c1df9c690eda65855e2e52138f1e0bf2910d9291b8016e71847ab4be84fa76f547bfb89f0588b24a2d70c7791b8c6ee72c8ea7
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
808KB
MD59f8da0ac7743b2ac9edcaebcbe6d3397
SHA18fe5f6297274ff05c59ed33170142886d1cd6471
SHA256e22154610c677af11743c61fd5e2e8bebb1f4dbd2a0e3ce7d8536b665427b2d2
SHA51286fcedb3675e10de00678868b2db91a3e5092a5119d7d75be882c832e6f2c727a2beab791454f99af3cbfa89fcbd2390c7fb347ed0fd4b264aee940f41e0e186
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
804KB
MD5e8d434bd58232c8cb33bba1771b0f900
SHA17a95a775c3662f69fc095f658fc80625de1804c3
SHA25602246dc3449851a9c7ed7a1e051b897415864759bd5cde6664521d0af8076195
SHA5122732cc0e7d1a1870d99d3f3eaa31f62afa3b25fde06e249380b37b6ff6fd6e687530193e8a7bb0a963b4da6a3ba9078430583ef5a0637ff2d65af795bc0efbe2
-
Filesize
981B
MD5c52be938f70b326b907a81161c3b5f53
SHA14601265cb02a1f7b05a329f26518b6031e1dbf24
SHA256380fa57aa6cab1882c13fc44280535b51a89d334d3f377696816555bffa764a2
SHA512fe1ff6573510afa31c47be9ef8f631bd52038208fa929cf648bd3eb27744fad76bd0afdec3c41f549fac89a30ae332766a4eaee32d4497dfc00c2450ec7ba2bc
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
804KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
800KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB