Analysis
-
max time kernel
119s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-08-2024 05:23
General
-
Target
7c3a8e39caaba9e165b6efabcc252390N.dll
-
Size
1.2MB
-
MD5
7c3a8e39caaba9e165b6efabcc252390
-
SHA1
60d37686a60274736af35b4c2b925d02fe78b551
-
SHA256
95e951126f8b7bbc7efe78abad5a9d6db1a53675843cb48847377b8cbfbdc67f
-
SHA512
e08a4c05041bbc83772e31d472547ee0ddb0c246e9eaa271952d40410cc8a573b920e7d1375d6708598a3b7ca9846b152466d4451bc16a3555ea36c84679f66d
-
SSDEEP
12288:mZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:mZK6F7nVeRmDFJivohZFV
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7c3a8e39caaba9e165b6efabcc252390N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\mdJd59I\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\mdJd59I\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\tMhWoe1\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\tMhWoe1\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\wy65KMgIG\Narrator.exeC:\Users\Admin\AppData\Local\wy65KMgIG\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\Cgty\isoburn.exeC:\Users\Admin\AppData\Local\Cgty\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5bcbb47c3a5756a55068e46b3e4de40e6
SHA129f4db8d3a3e11356b51584e44d8595a5a65d56a
SHA25619c5fa8dd870daebf4e7ecf880ce4049311319178363c06018b57877f4714a60
SHA512a0759231719da1684d0d211f71259b32924863dba99fcae524640020b5376f2d895451c71937ef715e4165dd605f1762c90450477b1f070edeb514661c910bf4
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
33KB
MD50d5b016ac7e7b6257c069e8bb40845de
SHA15282f30e90cbd1be8da95b73bc1b6a7d041e43c2
SHA2566a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
SHA512cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e
-
Filesize
1.2MB
MD58a1a6754b14f6bf6225475b5557da175
SHA13c035daba56b47185d05810a2ac949d0fa40e29d
SHA2563b305d2979924e4fd7967eb57555b6edeee9f9d77f5133a9591077e75b0c4625
SHA512451221adf1f008e18f6c9e1b9c580ecb7d799ba075575b30ccdb9d48209da2f15a8be7c7d692389f9ade464d03855f456733fa4bd324ed82002944be4dbbf004
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
1.2MB
MD5c463e4d1c5d11e536ac30d4792cc3250
SHA1372bae4b0300d87c7c458153d10e25eecf1054db
SHA256bc07e0f29727a03d80e937c4dafdb8b95cb0c432b5f4166b729a0e7f67462ff7
SHA51204be2143af7e23bf5d6ad5ffbc2ede1113dfac0513b333e4aa1b32813130e562f36881a0531d5eaf14622d5a3875513fcdd9d4d63016c8da62ee7d215588244c
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
1KB
MD5b402595f32d0e6ac651b5fd32642975c
SHA13a7faaba216e36e3b83c12a7db378791b9d7c38d
SHA25625f03c9ea666c763829655bdd615172d2d6c5bdcc7fabef36bb4292592b4aefd
SHA51239b71f88828d630525db09fe342c03886365b035d07c34dd17076c96ad65a581720fb2fa0ff421351b18a3ca679abda46c7298b5ceaf9febcb6f9a7bd4fe5d5a
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB