Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05-08-2024 09:04
General
-
Target
72e1aadf72bbcfb50588b5878a6ad6c0N.dll
-
Size
1.2MB
-
MD5
72e1aadf72bbcfb50588b5878a6ad6c0
-
SHA1
4094dc12ead34082dcf9a3d0bbe2464cfc72c8b9
-
SHA256
9d79d18b0cfd87341dd03d51ba23ed13914c3d15e3fdae4fd9aedb6b0bebc08b
-
SHA512
74933b8fbd6a01925a193a3641aae3cb135fc7352d9c1d5e842f836b9b4880971c4639dfa14c1b56ff3fed5bc3b1d364e67792c6922f526ce604c468d229f193
-
SSDEEP
24576:CTEqOo6qzOst9D9GDeIwvXKgMuJS0WQKz:5lqzYDeIwtT80
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\72e1aadf72bbcfb50588b5878a6ad6c0N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\QAyAu\DWWIN.EXEC:\Users\Admin\AppData\Local\QAyAu\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\b0L0Y\wscript.exeC:\Users\Admin\AppData\Local\b0L0Y\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\Tgx0s\AtBroker.exeC:\Users\Admin\AppData\Local\Tgx0s\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
1.2MB
MD5f50e24952d6f6cab149c4fe44d85f43f
SHA10b129c3655269057c5fba6216415359c97124d8b
SHA256c9af8e9d8f3e779c57674dfae83422c754574072b2e4418263400b942ebefa03
SHA512e7bfc46cae22848b5b422c300984ad68e1fb722beee19d01647936ad9c639823a1270d4d09b9cb917f12eef21ff9160520429fadaaefa3d9e83af91320f70008
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
1.2MB
MD587e93b8339ffd6c008ecef2bee94ca8b
SHA12711ed2a7a55d26efbedf4b624b7bd3a4dd72eb3
SHA256d3dcf22a58b9cb710a4624b76da1e3cd74eaf3bac51e8d3dd9d5b95850fc7528
SHA512260c7c193b9b481a0179424190dd56b3911e940f727a2554b6dddb014dcdeb60b68bcf84a0f271794d0ee9806970c0cf2fa71adbf6bfb904bfd2c6630da3f233
-
Filesize
1.2MB
MD5e21620e9859e121557522cead38d1172
SHA1f4e3fd983284d21f9a8aa58f3bc50299c63752bc
SHA256d9447e5007f7982850e1782627833b85a18c4dc2e04e3d87804a5dcdcafecbe8
SHA51266702d9baa144f4c2fd42f648260754d71b69e984bce32bb2f9d21e173449949750e2d560114c95a3de3e859d58733d1a3ac32e9f44afd7cc5155cf7fdae8266
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
1KB
MD51c64bd26e096a4757b863ded8b7b2557
SHA11720a62f6da161a6d7b261b6e62e4c4e180eab15
SHA2561406b0c474aa28499f0b3e15215027d45e603071a73b15fd2ed082b3dcba65c7
SHA512683b42f994bbc7911c40ad008695253964217e36a89415ea3e9e4938a5b3835e7fa47e3d8ec5687a2df5f8bcb2f62e52dd54fc0d77c72ddadf34a0e4f65a0b05
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB