Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
27/07/2024, 06:11
General
-
Target
f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d.dll
-
Size
1.3MB
-
MD5
81b54c092f50db01c43d91d689878cb6
-
SHA1
73994ee609cbf2d69e6aa97f01f0ee415182e622
-
SHA256
f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d
-
SHA512
7b690f470d6ac288463649c040edd462b658e4c0e7de3c6e23bf97196389a1effabd01558fad3afbb23a8060d0302952ad5e7e34eda5e1ed229eee2d19319808
-
SSDEEP
12288:sZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:sZK6F7nVeRmDFJivohZFV
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f9be8ead8c0c0eea86e3b21724ca839e0d04bf09396be2d03785fbae593f771d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\mE2HR\rdpshell.exeC:\Users\Admin\AppData\Local\mE2HR\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\RsVf6Rl\Utilman.exeC:\Users\Admin\AppData\Local\RsVf6Rl\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\OdjBO65\msinfo32.exeC:\Users\Admin\AppData\Local\OdjBO65\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD536c6b62d08d122c782dfc4031ca3c080
SHA1bd445ff69fbf9b86900256a17de14c8afec8a344
SHA2560e2a1905d0c11236ad88591f8f7562a847595f5ebf90e7639d74bb82fb3761f8
SHA512ad62c66f2d1052fb4b530163cb17c5e3fc1626eed84e3b0a7d91474ce7d6244e6ba1b1b816364fa25d182838d59d00c0df037e26f6a8ac0cdbcc586ad32f1ae8
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
1.3MB
MD5382e0097e13bcfc6fb5b2b4e89555809
SHA1032f6125d321c6cb608000b2e5e28f3ba2a5bb89
SHA256e15ce1bf8c5c191f0814515e659bca1b993c124999f6dc73afd5ec39d668437d
SHA5124feb248e0d8926f80ac58ace106dfe3c5ac0292ae6d7fdee1c371faafb9087d536ea6aaef0e1a940e4d7a1884ce16a637e65afc6c970c0cce0d1c57a73eafe35
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1.3MB
MD568351643adb3a8e95a877050f391756b
SHA156fc2384030a3a7c124749d5cd6e4bad42f66fca
SHA256758e389349124b47afa2984aafcc0f47ffb0d5fb3e592ceee1b2592523410942
SHA512c59bb549cbb94b4edeab558098ca4b36fcaa39e690cd6c425dfc62ca22627b4f4e8c6f7ef0aaec8918b9b4d96a23fb2d8ded5ad531a4d464c2777cb7fb6c8b20
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1KB
MD502d89bc1a841ff614ba52aeb3c6fe92c
SHA1902ad6d66de68cf89dad014ab7267bb20461e169
SHA2566bff3100b1e7429b5b6f1bee747ce113a06c7a2b0d0c638f9266eb82a71e21ff
SHA51203caf4ccfb73ee836efac77c9087c6d517a1b4b75b80b81bcb6d6a7233d62b21f1f503f00d451bbc4c3bf411969c12db7fc908f292d68ef62a856ad1798024be
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB