Analysis
-
max time kernel
120s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 10:13
General
-
Target
2c95150a2a42eb2f3393614566c343be1775ec323f2e468cef069e91a6feb7deN.dll
-
Size
1.2MB
-
MD5
19bc6fec7b7314abf0768d9d7164a4d0
-
SHA1
36c9ef09c516d62c1b1bc07062764c7cf4619e43
-
SHA256
2c95150a2a42eb2f3393614566c343be1775ec323f2e468cef069e91a6feb7de
-
SHA512
0f229a6c8546871b01e8ebb60720bc037a4d31bab95d49d843afdbc45d532f201fe0406550f74cc900eb8b3eadbcd2a0024529a2c223147f346f52c4b663b8ac
-
SSDEEP
12288:qxE0waBckFdlxVRZ1hcyknDb3PTdcGvnx10k2d2Y6q2mQpx:aZLVJxVHfcLnDTZcG/xmk2d2qZw
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c95150a2a42eb2f3393614566c343be1775ec323f2e468cef069e91a6feb7deN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3932,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:81⤵
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\cpyW2B\dpapimig.exeC:\Users\Admin\AppData\Local\cpyW2B\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\FpeN3Uod\perfmon.exeC:\Users\Admin\AppData\Local\FpeN3Uod\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\1rv9Nc\FXSCOVER.exeC:\Users\Admin\AppData\Local\1rv9Nc\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
1.2MB
MD533df89df1d35dc77f92cf581dee1f88e
SHA1f4fb7c13fbf8a7bb6775d712156072178d427564
SHA2568bd16a3271471dec1fbfd35c58b50ce7713fa3a0ef8a2ab0b7c3f0b62646bb37
SHA512c71321f142e000915c715861a8749f73ab3cf9b63cbf99d9677cdc1fbede1c6518ab5b4122802c0827b1a4bbfd17e741590325326c7513dccd42db309d57b9ec
-
Filesize
1.2MB
MD5f920fa13fb2506aa7381144b1c71c435
SHA1e8ab03e894f3e83ef9e77549cc3eed6202321a40
SHA2564b7956d0639bb04dfa51ca2e2f550523cc4c1b7e62e680dfbd87610ed13e00a2
SHA5122ad357e3a5a585cb1371e1d05b4a1d12b59603c310037c97ea68f5edcb56a48e5fc751085ee0b4a4ba8492b73a24f545927c557a52f8af83190c04c079a3e20e
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
1.5MB
MD54fe27af07f365ab310c64a3ac97a7a38
SHA1a2f08750563bef40106ad69c969cea404be560f5
SHA256721c14f8dfb51882bffb789a4fba8dfe80478da0ee67c377919b7ff79e2b7533
SHA51251a5cfcd999aa0a40a0c1285c08abcff6670795a3844ba8bf976ca9a69e095c54bccc4530521d5e77538af5dbc149a0fc505dabb8e2d0e5395507aecbf34205f
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1KB
MD52b33be6f70dd633d9a2e5aa92befb443
SHA15abcfcf4e07399f350d03f92b15a9459a0d3c5c3
SHA2568212131754a9b517ce3b0edbe0e42217e7d080f461794085bb0c15c44d98004d
SHA512e6a8cef222213ca4f840382d2e37ee2d4a568c496d34ce4ca9b714e49b76766ba3e400f57f5077f039c2bd84b90545e2cebe91cf8e453f815bf32f87721f3ebb
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB