Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
29-08-2024 21:00
General
-
Target
3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8.dll
-
Size
1.7MB
-
MD5
fe0231fafe84b0cc6597d9a92d2fb425
-
SHA1
dd78e81942b70120c0549ef8c8f6bb86e672cbd3
-
SHA256
3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8
-
SHA512
761c15381e5fd2836f8b53f2ccc70f16066e06fb6c279fbfd039df17749a14fbbb9200f5014330574a5375253c46d5ab5219133393aee480839f925ecc877452
-
SSDEEP
12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 6 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\RPG\dpapimig.exeC:\Users\Admin\AppData\Local\RPG\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\ZUpZLE\spinstall.exeC:\Users\Admin\AppData\Local\ZUpZLE\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\6sCu0DgCh\FXSCOVER.exeC:\Users\Admin\AppData\Local\6sCu0DgCh\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD53aa5d9a3fc668b167748474f33ad527e
SHA1632ffa402d6412114913e165812ddcf219274509
SHA25619f76891332cb64580382a3635d9106eeb5053ba4eb11c3ec21b5b3135f3fa6d
SHA5129e0a2b2c7774592e4a463bc7cde3dc0095fe61fa8859bfb451d4f4b81901a0b90a754f396f5e7a76d7dcdeaa7fb208cf7de425ed00e20e67725c8ee01434053d
-
Filesize
1.9MB
MD591ae122106d4770d3d0751d995bb6c07
SHA1e32f317da4f49c8c35e6adc4a0e2440014878e0a
SHA2565b110f288ce8965e173f0e62183700ad3b1f104b8678e21589413204dcf1baef
SHA51233619543b8e812d3a1961ca4f74d7fe46aadcc7887d20893c21b4022915c2a3e1e648e780c31823ed7bb384dd82467813894ed0c168e548de679b5ba8b878430
-
Filesize
1.7MB
MD560bfa1e9e95a86d6da1e67fc31f61190
SHA18f260baf47deca4237c79b2b041db871f7313e06
SHA256eeed5b6432c1ae0a5375d6aeb5c2994d7a0e599772298ed3a862eb174cf82c9c
SHA512ec801f87ea618e2198ab9f0a49986e04dfeeb80c351b3ede18d458960d2573a2196912c669b98c69490f9a5c730908afe31b635fdbcccb8c7f78ac25726dcb0d
-
Filesize
1KB
MD5d5f4b71aeb2dcd52469cd85fe4a7b4eb
SHA124dd049e38284624b25d1d0b04cc41ca33503bdd
SHA2562ee9793cb452f925290559acd3dda774b6a98e873cf1d9f09f4040757e5b904d
SHA512c5f6ab79d4fcfbbe9871f44f497e95aff9990eb283290dd46cb4de3c5fff68fc246e7f57e5efca8fe599f63a1168cadf763608be1f140cfb5e1eaeb29a301211
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
73KB
MD50e8b8abea4e23ddc9a70614f3f651303
SHA16d332ba4e7a78039f75b211845514ab35ab467b2
SHA25666fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1
SHA5124feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
28KB
-
Filesize
1.9MB
-
Filesize
1.9MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB