Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
27/07/2024, 06:11
General
-
Target
f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d.dll
-
Size
1.3MB
-
MD5
81b54c092f50db01c43d91d689878cb6
-
SHA1
73994ee609cbf2d69e6aa97f01f0ee415182e622
-
SHA256
f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d
-
SHA512
7b690f470d6ac288463649c040edd462b658e4c0e7de3c6e23bf97196389a1effabd01558fad3afbb23a8060d0302952ad5e7e34eda5e1ed229eee2d19319808
-
SSDEEP
12288:sZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:sZK6F7nVeRmDFJivohZFV
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\8kxswjz9\wextract.exeC:\Users\Admin\AppData\Local\8kxswjz9\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\h5qOV\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\h5qOV\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\KZ8q\mblctr.exeC:\Users\Admin\AppData\Local\KZ8q\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD52eed6980393c158d6bd6e16de5462de9
SHA1a6d24f08caa85844e96c5532a7ecb4d557c10e20
SHA25692f37b00e124f67a57d3fd3e01718618541ca5d117081efe66e7b1623aa7a3b6
SHA5128a5e1233fd20f05ee82b01292ad663da7fd838fd3090668fb90360c45e6a243a1cde8d099f85b32c70c44b812c540bc6a2203d276a55116616f905debf1e7ea9
-
Filesize
1.3MB
MD51ac4381155a983e517af76507df07ccb
SHA1bf26c59b25a4ff7935cc5447625a5ced2d19fdaf
SHA2561061e7dccab11c5f9c6c047ed8f997f964b1c423c4f00334a66e530e8fa8f0ca
SHA5124d4ef6209df58090bb91493807cd26ec48fcf092423f4557fe3c3521772be137c7fb808a5fb20b111a0b2e399c6bd6a9dbcb86dc2c1a75eb0dc9de5e6b617301
-
Filesize
1.3MB
MD5101ff3ea82e1d246c24ab2767fc27eaa
SHA18cadafc6985e00b7cf86e8ad749b5803c9577640
SHA2562f6680bdee3ed3c0a21f6be7b398719cdc81dbb3cf92ecd7679dfd4f5ad6ca59
SHA5125972d608dc5552f19b5eaa7c41171ff18d2de4204bcedc6590036923d8ef4bdd9147d6462a2c44d0804097bcc98e1f0dcddfc723c5ec09c1fa04f5ebed87bcc8
-
Filesize
1KB
MD5e50c413e508c6575b9b26e8e1e95561d
SHA121a469b48ef817054e96f2e4f31f10acf66ba60e
SHA256cf081784118944da65c63cebdc30a64a3524f0670e871adc01f393a7ae4aaef4
SHA51243819c4c5f5141e142b49071840f004d2e3657b6921166fec7668f075a3592ecc424061f3d817ae80b2b00d0852de1146c8ea0b7009802e86adf2f55edbf5dca
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB