Analysis
-
max time kernel
120s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
19-09-2024 21:11
General
-
Target
NoThreatDetected-d2a9857b2a44d8a2cf5c90cb47040135626aaa7e4312cc91be2bc36c64edd08fN.dll
-
Size
1.2MB
-
MD5
4c701019b6ecf3b6447881b611b63ec0
-
SHA1
38708fd32051761d67ae4eedfe9a3de15bee50fe
-
SHA256
d2a9857b2a44d8a2cf5c90cb47040135626aaa7e4312cc91be2bc36c64edd08f
-
SHA512
102b79e9ed116b503d106a44e3214354c0dd30b2c29d6be3d19df4236a5c7a5acb2238cb8268358ec216d2aa41f5ed33ccf96114834cea226b369f788268af06
-
SSDEEP
12288:lxE0waBckFdlxVRZ1hcyknDb3PTdcGvnx10k2d2Y6q2mQpxU1:XZLVJxVHfcLnDTZcG/xmk2d2qZwy1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\NoThreatDetected-d2a9857b2a44d8a2cf5c90cb47040135626aaa7e4312cc91be2bc36c64edd08fN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\8xT\ProximityUxHost.exeC:\Users\Admin\AppData\Local\8xT\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Users\Admin\AppData\Local\ObBnq\quickassist.exeC:\Users\Admin\AppData\Local\ObBnq\quickassist.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\Coseyi8y9\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\Coseyi8y9\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
1.2MB
MD58322b7c9cd5812fed57f870abaa91663
SHA1e181c9d2ea61b3b5ceae7ab5c71e13a82775777f
SHA256424ca2d67af5bfa41d3999f4e6c94030fcf8a8871ccab4b2183603ebd5236941
SHA5127cf715cd1377f7b0b95bb72a2eb00c8fd86ebff325d85d775b766f822b77e263313d560255cf708388a4ddfd2f2a44f027a66e11f794a376deab61b0dd4cc8b1
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
1.2MB
MD5f1cbe57fcdb3176a39de95d3c78bd7f2
SHA10feeaea56349e9bb9dc7bdecf27558a2fb1d1491
SHA256cdc416a435b9e999862e245e63a18a51dff2c8b6921b6995d987357cbde03ae5
SHA5128e4c516143c4783c395765b0fb33b860d0da6be8b9a04c9828db4687c61ed719de87ec8a50a772fedee467d3f1226af48871d9ad6609280e0805236a62bc7cb4
-
Filesize
1.2MB
MD5c8e2534ed632df4b79f916b993d4d24b
SHA10b5991d1bd0cfc4ec7ac5ad224821431163e92d8
SHA2563f68ca70a6a7b83d29e6d4fcc3d5d07fa906ae34a75b66796329a5b9d86e4a4f
SHA5120bc06403d52ece5a44466f8573b874998a37385ddad88fa73e15b1bbef1abe90b47ede7517f2a1ba08cd1e737457bdb966cc63c8d8b1f99c8d200f36f5a504c0
-
Filesize
665KB
MD5d1216f9b9a64fd943539cc2b0ddfa439
SHA16fad9aeb7780bdfd88a9a5a73b35b3e843605e6c
SHA256c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2
SHA512c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567
-
Filesize
1KB
MD5a7e79af3004463f26cbd929aeb5b2de7
SHA1b878f406c34694e05cb64faeafba641117597229
SHA2568e0206b1a0eb37ea53d790f5460c4fc9d9559ace1e56ad3a2f5d74b660c54f04
SHA512325505ba030bdeb379ec355233533227fa67f6469d403c933a486fc75dcba69014f3bf355b5aa48f39efa08e71e3ec98c6795f4d7d470d4fb95be7c0593f46da
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB