Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
13-09-2024 02:14
General
-
Target
c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f.dll
-
Size
940KB
-
MD5
eac9db11159f94acffc10b94097debea
-
SHA1
c2b90ec31a8ba440f14131e5598cecdc65db300a
-
SHA256
c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f
-
SHA512
4c33638e34a9dcd5f05dab7f212c3dd8c0f293f5f61eb582420171712b27474fa043f1649a6e35c07f1c32afeb981027d14c6fae1361d788c29bb5144e109911
-
SSDEEP
12288:H0YTYL6Mqi7W8xto9OpWswk1GNup1XhBmsUqOZEYUANgBomHGe0zcPTP3E:H0CYZWgtWkEuHXhBmLHeuWBomaiP
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c993b31ce40179bd8997e6a298875c02744cc7d07225dad945a88d7ac755515f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\5ht7dk\WMPDMC.exeC:\Users\Admin\AppData\Local\5ht7dk\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\DJveWAIk\ie4ushowIE.exeC:\Users\Admin\AppData\Local\DJveWAIk\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\lPN4c\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\lPN4c\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
944KB
MD5eae1ae0afb5e5bfc7a0499d188286a0d
SHA120f2e3b391447176dab61734e170d9b5c0416818
SHA256f3c3107f4a48794fd8b91aa0e0a238d909c1604c6c26edbe54d90e42e8268f2a
SHA5126db34ee8cf82cec331b6a693e0c26903e04296dc1f2ae21453424c38c93cc4a93f5ab881e028d00b936d24da8365e3e8031e564a81c5996c696e13c84b678d9b
-
Filesize
944KB
MD547af5cf973b701545119c6b52b2c8a17
SHA14d92a0378ba76b7233f028190873c325d211bb52
SHA256968d9b14e98e2b074ff36b184fe95280687de799cb5b035f00cb7f10065b1db2
SHA512531d0747183c9f999cba0f83ab297c2b6799c09511f34a3e884e7eca9dee3c2d7183d2aa283f932488086a1991b8e70ebcc52602f7078213a3006d8ebc762d75
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
944KB
MD50d13c367a5d240ff4c10f80e836ff758
SHA1f210e18e4d1b576ec641bf5f9c956411e8bc214f
SHA25629ab5593345650b26887ec71d45bf2dd595117a39bc23cc171b98488fce94e40
SHA5121bce1fd0fcb1d782e4e7fe936675dd5eaa4cb893ef3440efbb53689c04f29b2713e5a6635c72ecba983f32a9adf82145d6da8d5fbb70912fb690536896d04a60
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
1KB
MD5b15ec27caa15599e58b95624e9c35fbf
SHA1deab014e92363f12bc4c686c1d1c3214b5da63b3
SHA256aed34adcfea2453a93767cd0e825fd40ef950945f2da23c77ecd2f59e7de3916
SHA512f16149350be6f2660b69f7eb56e1cc37ac16dc704603f598f3cf4937ed7955a8883dacf602e6499f878dec48e238deb320523cd364dc34a69d6dc795ba90528f
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
28KB