Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
29-08-2024 21:00
General
-
Target
3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8.dll
-
Size
1.7MB
-
MD5
fe0231fafe84b0cc6597d9a92d2fb425
-
SHA1
dd78e81942b70120c0549ef8c8f6bb86e672cbd3
-
SHA256
3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8
-
SHA512
761c15381e5fd2836f8b53f2ccc70f16066e06fb6c279fbfd039df17749a14fbbb9200f5014330574a5375253c46d5ab5219133393aee480839f925ecc877452
-
SSDEEP
12288:VVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:MfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3cc4b7ea1abe6edba734f9be8de5a30d2486816545a6bbb6886b7138921bfde8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\bYy\usocoreworker.exeC:\Users\Admin\AppData\Local\bYy\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\byPxeBY\sethc.exeC:\Users\Admin\AppData\Local\byPxeBY\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\KFJi1\ie4ushowIE.exeC:\Users\Admin\AppData\Local\KFJi1\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD575bc6d835802022b9ba8e95ca646a93b
SHA1615eab66a53414c30a1c011f2a0bb39c2e8263a5
SHA256bd6c8bf0420a330c4a431cd2c6eade56636043172599e6e02de5231599a74695
SHA512014e95789f2e94cfc94dab1c45e5c7e28bcce1db4d2b8f8a5fb41c4fe5a84eb91123f54c3c8d1b1e48338700ea48cd5cb62949db3c5ad20f64351d464494e409
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
1.7MB
MD5d04e33d0ff3c02d31c26e3de15212c83
SHA1ab1d3c6a71ecf660b642a4c9049a0b6f20ebc9da
SHA256ed0da393e08ca2ed3de25d475b0cf918db240ff197124052b9df71d0865aeac9
SHA51291e8acfe15e24830fd38836e2686bb8269fd9488de1a0bf3cda93dfbd922147183bccafad5995351f3ce738871ac89db02c4f48ebb98203af2b4ed096091787b
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1.7MB
MD5d1dfaffb9c7373d5db4b4099719db597
SHA1c4a8efc110be346317aa5c89af7ebc1a67ecdc9a
SHA256623ca597d8fda34fb29534a7eba6bbd7bd742b67f64c1d9df9b58f2f68591fac
SHA5127ad62cf45bf2800f1defab365d7087fa68dea7aa7b9109834fe4d11fdd4dc34ab6ff6bf46bf4a035b429448b8083ff7ed8c294d4e555da8c4788a9e4bbdee5ca
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1KB
MD5e0e45a8e3b4884c7fdab34b74fd4bf4d
SHA12a82bc5e60ff20aeebc0651902e0bdb55c7b7319
SHA25670ee084a15cae51afe40484cb90cfe2f49c575246d7ac83b596c43b16618c08c
SHA512267beb052138064d84dbb6f8035166da3f37106ef455d173e1965a4bec30293741195dfca69c9ea5ca852aa7b4e38f7eb10faf27fa3379f48a5735a325857237
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
64KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
1.7MB