Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
10-10-2024 20:06
General
-
Target
e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270.dll
-
Size
1.2MB
-
MD5
5a0c4c42f5e08a8c849585c2e879144a
-
SHA1
510fe0f87805421371b01665c7ae5f99b74826b1
-
SHA256
e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270
-
SHA512
2511f59c1e6fcca80327d870dcfd4c76bc9b028956fcadab17fcf7d052b6118d5d672b5a26c6db2fe5c4e23279930c5baeadc72e1e427a8cfcb3600cf2a23f8e
-
SSDEEP
12288:ZPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK85rQsy:ZtKTrsKSKBTSb6DUXWq8is
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\XIH4\osk.exeC:\Users\Admin\AppData\Local\XIH4\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\RXxs\Netplwiz.exeC:\Users\Admin\AppData\Local\RXxs\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\x01thTeQ\winlogon.exeC:\Users\Admin\AppData\Local\x01thTeQ\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52bc0ec33151ca03a81c241a0e7267c11
SHA1d0cc7c018408d63bbba5fcdfeadc2eb41f04d03e
SHA2568f55d766ab346b5bef41e5bc2b83259cef0f6934c5da9fd01e87444e515b466d
SHA512bd7f448917f567e15fb6247b47ec959033d5d213bb484fd379dc07972be2bd95c6c62cc4372e13d610e22675ca69f57442da90286bca06d67882074baa041a20
-
Filesize
1.2MB
MD5db3c3d552b842a19a3e12c5ac466db9c
SHA10f246dbcc4bd094b37ccdf5c98e60fbc7ed7482a
SHA256ff4de7442ecf646f0fb1cd0f8c6e100704690f79c3a70587e97a4fbbd9aee3db
SHA5120c9e062171a52f37e6cec35978eb44e11989caeef82c75bb8562470dca39a5da9c2fa264b9a696dcb663b74d77b17bf5a97c869d52aa3c6c8e3b131ac31059db
-
Filesize
1.2MB
MD5a901e7c6d3b1a7e2114394f80cb2387e
SHA1d9a1be1f0aaa6e9ba5fafb60c309b67c5e8681ea
SHA2564c5576ca89f73eab8ccca04cb64b028877d451ce1bf4ef7981708af8b40901af
SHA51295f673d46b58949e1e389d1737726d7a4039778398a8b2b7c76661d16903dfa2321f71b7dbe6f25dd3e3544ef8bd60ef3b92c8f60c74d653b67ab1dccf9f8e7c
-
Filesize
1KB
MD521b832207dc47983bd5a1ec845ff1bdd
SHA13055863e38ad7cb2eae8a9317e4c31569ba49ad9
SHA25676456e44870a32e2d15f3ea38102e4272b2fa1dfb39eed0c8ae1f4cc5859c34f
SHA5126f31e6f4a0b279cd824734640be218c4aeb92e59afeba4450e6dbe34f9acff4a55e10b6a97d421a5918674fbe16210ef3528cea04cc00d967136b2146216d92a
-
Filesize
26KB
MD5e43ec3c800d4c0716613392e81fba1d9
SHA137de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB