Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-09-2024 02:14
General
-
Target
c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f.dll
-
Size
940KB
-
MD5
eac9db11159f94acffc10b94097debea
-
SHA1
c2b90ec31a8ba440f14131e5598cecdc65db300a
-
SHA256
c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f
-
SHA512
4c33638e34a9dcd5f05dab7f212c3dd8c0f293f5f61eb582420171712b27474fa043f1649a6e35c07f1c32afeb981027d14c6fae1361d788c29bb5144e109911
-
SSDEEP
12288:H0YTYL6Mqi7W8xto9OpWswk1GNup1XhBmsUqOZEYUANgBomHGe0zcPTP3E:H0CYZWgtWkEuHXhBmLHeuWBomaiP
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\Aj9kz\wusa.exeC:\Users\Admin\AppData\Local\Aj9kz\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceDisplayObjectProvider.exeC:\Windows\system32\DeviceDisplayObjectProvider.exe1⤵
-
C:\Users\Admin\AppData\Local\fjYFq\DeviceDisplayObjectProvider.exeC:\Users\Admin\AppData\Local\fjYFq\DeviceDisplayObjectProvider.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\AkW\calc.exeC:\Users\Admin\AppData\Local\AkW\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD50e0859d7116b42b3342c0e560a0bf508
SHA13a3aa1245e3eb21213376eb6e6ff30b321d5d9ee
SHA2562c5748560d5dc952f2ab4e79341ad632c6b4ce1dd05e90d04447b2076b3b87d6
SHA512e71851254af201b09b3ff639240c19699dba4d579ee3fed79517b1b432b3af55e93b01100af3f7d40aae8d0b77f839b270ce4494d1030cda38032fa5185c165c
-
Filesize
944KB
MD56cfd118462f08458d24e0792f4195a6d
SHA12dda1644d6064d2c547263a9bde83981418b1082
SHA2569e63ab8574904fb94040744d79f7d948ae9bc386294a8cdced99033f6e4097e0
SHA512983731594f75d84f96b112152590a8f81a6d937379ea4731c3a723ea1c1cd6e1fc3d1a7ab35ab7a8afd355c2db61ac4aed28c97f8f8ce6579d56ca172ac8aead
-
Filesize
1KB
MD596bedf72c78530c83cf6cafea6c7b3bf
SHA191e9d5de2638afbfa2b674a85a57bdf1aab96312
SHA256c8350d3a5a6c6f645342bd627653f2243b7342d74edef314187cecfc0a78c941
SHA512ad5005089a58f4e7ac554184e4a8bf513aeb39b1bc82ff539fe60c3b9d3b2456f04209ff3755fbd692da9345b4d039a3b30f807374b336b7a45d7705e9f69b62
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
948KB
MD55ddb6742630694b5e04f9fbac63bc6f3
SHA1f34191cf57d8c15ac32b974e40f4ac0edd5f7977
SHA256983bb4d064e5fee6983093bff8ae580b640f321eca6aa94f33413ab8b7622a57
SHA512b039905679beb9b76c7382a8df11f10bfc7e59003c25f2ed73b74163a4dda960974e10d5cd2a456dea733ebafd4715a476de00accac219634e3951c470369929
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
109KB
MD57e2eb3a4ae11190ef4c8a9b9a9123234
SHA172e98687a8d28614e2131c300403c2822856e865
SHA2568481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0
SHA51218b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB