Analysis
-
max time kernel
119s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
26-09-2024 12:12
General
-
Target
b9ecfcc555b3841fc24b5cb6c4a867e272ccfd9ab3e847dcea0a33f7da5de2cfN.dll
-
Size
1.1MB
-
MD5
a963e5563d9df9750d85194fad36f820
-
SHA1
c9915fb3d1a2e116afdd1f72f4c33c24943c5978
-
SHA256
b9ecfcc555b3841fc24b5cb6c4a867e272ccfd9ab3e847dcea0a33f7da5de2cf
-
SHA512
b70b0d7dd65c59acf9609991bc3853926d06c557102a1a803007de42ce2efbc9291f587f1eac7ca91ab23b1f84be44f4403760397071406608bd349a17ee8eeb
-
SSDEEP
12288:IGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve77:Z3JAvRl/fKQKCgFfx4P/va7
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9ecfcc555b3841fc24b5cb6c4a867e272ccfd9ab3e847dcea0a33f7da5de2cfN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\89q7UvDh\mstsc.exeC:\Users\Admin\AppData\Local\89q7UvDh\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\09Ggx\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\09Ggx\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\6OxDy4\dpapimig.exeC:\Users\Admin\AppData\Local\6OxDy4\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
1.2MB
MD59de1e39dce5da4573a1cab8ce03d38b5
SHA1ae4643f4c5e235c3aefd6980b59b67d71dd5f358
SHA256dc4e6d0803257575131cc0453ed3f556c1ada3a16ee76ecdfe4781ce51563565
SHA51213db648256313a930c97c6ecf568022db9c40c052a109fb18a58042e097b373c74bb0c81f3963f823b62c49dfbc78d5445dd7e396bd95b1bbb7a6a310aaaf6dc
-
Filesize
1.4MB
MD50414d2cf8316db1c8cbcf15b15c728bf
SHA1f5eeefa64d42d0789b9bd99b50fcde642a8a56f9
SHA25662ec07d42c0c03b44d31458019938fc6f757104289bd1da0ce5fd76c6a7c2e10
SHA5123403d8dadd9965eb6521444c45eac3d25932b99c1d8b4dbf40356624d1127d94b26c4226e3367d14771cbd389306b24ffa159d4f47b5a3bfc4312b5d6e319d1b
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
1.1MB
MD51369df7d2fce79daa798c4dd86d45206
SHA1508cfcce56a99cd851677234f38ab955944b1ea7
SHA256d9b49932eb6b188afe17b5e539ec3c5970747e441e99ba84f52dc3d1f58d8484
SHA512d75ee0581de3aa47983dcd34ac4e4b1d50099bda73a3d138ad65375c68e27bc4dcd8301d71f57b7a8e43189728c17928d11d36fa34463857bee2b7bf7274acc9
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1KB
MD5070528b4b7ac7262fa442705d3911346
SHA18ab9352be17aad417de4831e1ce5a65b0272010a
SHA25696b74970d4e3d6b310853ffa30fc7169227df012b72d1425674d56082c0b1c07
SHA512ff6d3f44fe3d7a79266fad273c61988ce3b987a817e4f4f06b3b1efaf63d56880801d3b615e5b5519b4859ccecb2097a5b5df6d60f30587d4b4a4c554aad1e4e
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB