Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
06-10-2024 19:42
General
-
Target
e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0bN.dll
-
Size
1.3MB
-
MD5
3caab0352ba2d33f6e283006aa3349a0
-
SHA1
c88e6d554a0cf2f1f9d05867ff0a7607d683e486
-
SHA256
e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0b
-
SHA512
ba8acba77d747dce3128da81e1b68f8352ba15e7b75beeee9e78922c3240acbc9348b1979b0f5ec819200c0d9ccbfbd3100e1a58fe0f1c524c5d5460d762527a
-
SSDEEP
12288:MdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:+MIJxSDX3bqjhcfHk7MzH6z
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 32 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e83967e75410b28a9ce51b667e754b0503df3d3e4861f56a1df8914d611a4c0bN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\TTo7dJ\Utilman.exeC:\Users\Admin\AppData\Local\TTo7dJ\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\7H8j\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\7H8j\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\2xntl\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\2xntl\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
1.3MB
MD5d0ab1cb8c36de5f567ceedbae0afc112
SHA1bd7e13de661bbf6c25d4518586111621643f72f4
SHA256a9cf183edbdd8604c1d0265a53e5f37ea84f79d2ccd06c3d13b1f71afd95c3fe
SHA512923c115b88d1f928abfda749572333e9013e98146b7b54a9e3e666bfdc00bb840b87646061072c854b9043e2dca7f980a22c58ce244d504e545cd755a5faf780
-
Filesize
1.6MB
MD5ea925ca3fca2d23e2df3e514ac54b109
SHA19095cc4b054936d605f0061d2c210262cd240db1
SHA25647aac72ecd1b64fe4e9a2eb6bbf02f15fa91f7cfcf37a71ce789d384d463d661
SHA512555bf774d4b935de1812c1069347aa48e316ef0325429e4a591258f002a63f1230c7829f07609ed80d0254f5242dd8d0c16fd5b7a5c7dddfb7d9b79fe5dd811f
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
1.6MB
MD5370a9421db3427373dae82b021fe76cc
SHA1ac9fdba921b70501a818e03118de0ea121347002
SHA256ba895e785fe1b3e33e4a29a45a17f5b62b097cbd3b9d8e229e5d8fae047e24c1
SHA512a92181b40a6c9dd666ffde2b81b579546dfe8f71017422ceb749c2e62a2ecb3f67c37b3ff860125cd2c83be250a9abe1cd1eb41a1eb336724299a29ef233e94e
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
1KB
MD540f5b7b611a02a0e39156c8cbebdc477
SHA1d6d2c93f2993e4080c7fbabcb77e266c72aae72d
SHA256d2c5ac32c626decd3cc1417bc7ab295f30d61b83e6d90b5a1b4ddf320266ce20
SHA51203a44e4e618d91fcd0f0fee66527316804b1c4be44b8df07a0ad902d65cb9529bb1ed9520ded65a73ecc6090d002419337838269173a8e56ac6b5597bf6631a6
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB