Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
24-09-2024 19:18
General
-
Target
d8f78241f9e732ff57f1f307c99d7e27796829927283172653634470ab9b90aaN.dll
-
Size
900KB
-
MD5
338b828676d1d088ed1bd3a335e9b780
-
SHA1
4bc3d044e35d9953a71ac426c212b6a3c9de509c
-
SHA256
d8f78241f9e732ff57f1f307c99d7e27796829927283172653634470ab9b90aa
-
SHA512
f4f97fcba6d28aad4cc05408cb97e96603b6cab093317457cf72a4c2474114d7dfbb85e0b1f381e1a56c55221db7f4d1cec54e846c31349258f4dd72e0d702e3
-
SSDEEP
12288:MGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7Y:t3JAvRl/fKQKCgFfx4P/vaY
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8f78241f9e732ff57f1f307c99d7e27796829927283172653634470ab9b90aaN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\0XQaG\lpksetup.exeC:\Users\Admin\AppData\Local\0XQaG\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\4kVAA\calc.exeC:\Users\Admin\AppData\Local\4kVAA\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\ownfu8\mfpmp.exeC:\Users\Admin\AppData\Local\ownfu8\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908KB
MD5a9f803618c45c8a7fd047caff1c389e1
SHA1b64f94ee5bd147385c48d2f8630529e762f41e8b
SHA2565b47b649921501108f2c8d05f579a048852ca091275b7ac76211bb9b3ec40010
SHA51297660e049948f7a9205850bac22465429b65a247b9fc33aa4ee8ef98716fbd3fae30aa10fa74979a071130a971ef0b04ab8cd538929bb53d51d311de8334dfbc
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
908KB
MD5971a23d88317d2b7d61c0fe028d52c1b
SHA1cdbc8bf61b0554c16ee4e201cde1e8302d856edd
SHA2562dfefed8202a03c009e9ef13c2053af40e5bef7ab5cab56de98990cdcdb7bac8
SHA5126b8051b441b46933f6b5a622fcd044968a2f786661fb5b50fe752852990cadb82e31d973fd01c0e35b749201fce5f3abafc1b43f5bdc2446dc3ab37d9f24df5a
-
Filesize
969B
MD540556f2b6614b30828ab9b4181b19e20
SHA135d28681c6c67f7fdfc46a1fd77c0d831311cbef
SHA2564364e3d18a02377ce8634cd8da35851c0474dc0cf5f0b990790beb3f2a9d0e9b
SHA512a286ddbbea98eec182c2f741fdcbba68f5bb2b0ad8c20c34f873fea175b8935a36937f2745da8d59b9480d2c515a466b97c2327190fdd00f88e0b77cf55832c0
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
904KB
MD5c735eff37bfcb8c641d961a2c1768b8c
SHA165aee8bda3dfcaf5faf9f106a998ea9ff2e8a5d5
SHA256d2a73b3b9e3bff3e96ce79fd80d5e4b34933346ad71d2d0ee6ad9efc7e028796
SHA512c954168c3fb77b2f07ed520196ad1436e8144e3e73b0592b635ae95e1e1243f3a9fd7ea58f3897586193d727eb653db54c29d9b15cc2e03305f94782c49c0613
-
Filesize
24KB
MD52d8600b94de72a9d771cbb56b9f9c331
SHA1a0e2ac409159546183aa45875497844c4adb5aac
SHA2567d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185
SHA5123aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc
-
Filesize
900KB
-
Filesize
8KB
-
Filesize
900KB
-
Filesize
28KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
900KB
-
Filesize
28KB
-
Filesize
900KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
28KB