Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
04-08-2024 21:14
General
-
Target
05b76b5a9bd812690471e49f77601b60N.dll
-
Size
1.3MB
-
MD5
05b76b5a9bd812690471e49f77601b60
-
SHA1
a937bc2cae7cb618db8c71dccb6ffa84f668577e
-
SHA256
2f31806a63ab5c10dae9614dcb8702ecf21f9cc6a91262cc75934dae299b534e
-
SHA512
547485b7dc94388f7333988d9086d504c134b79f4e99124e53c5f0f172071abf98af1d7c2f49a7b854de69c2395703d5a763c5390e615de0962b41389bfd1251
-
SSDEEP
12288:JZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuwM+:JZK6F7nVeRmDFJivohZFV
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05b76b5a9bd812690471e49f77601b60N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\FKcNywV8K\rdpshell.exeC:\Users\Admin\AppData\Local\FKcNywV8K\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\zW0Bxxd\iexpress.exeC:\Users\Admin\AppData\Local\zW0Bxxd\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\UP5\msinfo32.exeC:\Users\Admin\AppData\Local\UP5\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e9ade447bf86cdf0b647199d5fbc3868
SHA109ae70d08d4fd8a266194ad4e0d0debced32040e
SHA256b4ae53f382ac3c264c6812406e9f4a7ae73bcead47bb67ffe2c7946ecfe658e4
SHA512dcedd4f942a2551721c06e572c0fa349a9acc5322647078e79288f41cc34b4d14e7423ae5485ff431a2e8d6157749e64dc3bbcf1b9b7559538f7776e0e89da88
-
Filesize
1.3MB
MD5244d1b740d0047f72d2d1544bd89b5b3
SHA1f7e2bb6fde20cbe25a5ce09132625f2006d28ccf
SHA256314383c7f67c3c82ba6ac12fe0d9526d27e95ce4fb748398f35925a575e64b6b
SHA512e436138d45a9dccd0f5cf0fb9962e5193608a6cf7c21fd74992103884f42d178eac693605ec3740bc346b8e741b470b76ce583467d5ba4b84fe5d643d36d4e75
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
1.3MB
MD59f14e19a5e8fc2a5722309b757d6560a
SHA1f4ef89adcd80232023cafcff18ee00bd6a748c91
SHA25664e473a0669d75daf61797f1d0a4522d1575ca42f6213fd0085e57b3032a5c42
SHA512d1bb3bf9d007cecd0e3adbceaadeba222194c665f448466d1fc93db5b143a6d9209cf56187c2a1b9ae9998e127056a53a249e9b63f578052f767e7bd9277e0ec
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
1KB
MD5e1a469f8870a6d6ee2afc31afecb9004
SHA132d025938c96be4d2fd0280fe125f63741ccb6c1
SHA2569fd9ca3209aca51caea1a3ecac85d9b9578dab16179bc22657e2455f7cccf34e
SHA512129575c910b05f1ebadc07a3afdcfd7d9c684069ddf87ffea7f80deff7336908d2f7bff1307d711d19c2964ecf340a5f0e7a2a22d7cf9dbb6668533dd98eb452
-
Filesize
292KB
MD5a62dfcea3a58ba8fcf32f831f018fe3f
SHA175f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA5129a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB