Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 15:00
General
-
Target
NoThreatDetected-ddc50ab4f6757dd5480e6aa78969bc0b5cd646742b59bd90855436618a44ebbdN.dll
-
Size
1.8MB
-
MD5
e14d296a8d3172360c2d73bd3baab2b0
-
SHA1
0898ae4f9a6926d308a1e24e7f7a2fab85580541
-
SHA256
ddc50ab4f6757dd5480e6aa78969bc0b5cd646742b59bd90855436618a44ebbd
-
SHA512
1874fce4ac65204917ba183d5eb10ae607f9403b3a878f1bc402c80b36959e2cc71fc49f8115710d1a76d07efa5e2bc39429d075d9b4c5c517121add23a23856
-
SSDEEP
12288:PxE0waBckFdlxVRZ1hcyknDb3PTdcGvnx10k2d2Y6q2mQpxVOa:ZZLVJxVHfcLnDTZcG/xmk2d2qZwq
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NoThreatDetected-ddc50ab4f6757dd5480e6aa78969bc0b5cd646742b59bd90855436618a44ebbdN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\YgLJ9SX\ie4uinit.exeC:\Users\Admin\AppData\Local\YgLJ9SX\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\yBk\WMPDMC.exeC:\Users\Admin\AppData\Local\yBk\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\0Sy\dwm.exeC:\Users\Admin\AppData\Local\0Sy\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
1.8MB
MD551fc7e65eaae052cca5f4f6f6cdbe2e5
SHA1b7b604abc8098b12d4ace37704a4d4d813ba5731
SHA256e9114fee83a5afe53fddf8ea6c079a4be57e3cb97f8e2d0575451fa92abdf20e
SHA51288880734a6b48e5ca9e55140f5de31f45b98ed6832e45bda6accfacf5ea1684fd168ab112ce7a251be033164797f75657d2e24149c24b19d499346c2e16e80e9
-
Filesize
1.8MB
MD5f2608dc41072c478acae9363dbbbf77a
SHA163fb10d1ab07e649fc243811417aec78051f8125
SHA25684e7f2e4d62ee976e71d2fee195079d70243b1ec88fe148450b05951d589b87b
SHA51226b6312bd2bc9725960785b32c66c951c7015e6213265a87a2e45523c22d69cdf1bfffff0541ae6a38d127d506319bb78bd561cc25eaf5eafad4e4b80c414c38
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
1.8MB
MD53f887ce2df312ac5ae8e88ca01c97666
SHA105122e148511d43176b8a7192e7cea1c5931f08e
SHA2560642137952ff855fd633d017cfd60eaf5ede34d1b5c1b6e9437c19bc57b34bfc
SHA51215ae6bd25fdebcac9afff4271304705a2b142736d877be3048bff8238ebd67489a56ba940c871d29fdaa6f7246fc5976b086c4f443bc39670ca4e1e531cdf50b
-
Filesize
1KB
MD54c84574f56fec241a08de504b2bf2a2f
SHA17981bf1886eae4f2bba0d2fe5a65812e74c9e549
SHA256d822dc137c3bf16a8199bd566bfae34e26a53195221c4444feb4b68b379955a7
SHA512e20ec7fbb21c2e99709bd8c61b709d454005665d69850e911ee324ff3c4c7976a3085bdac013622f4907bc92dfb6263f61d654548cd6e9e103460376f7f28f0b
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB