Analysis
-
max time kernel
149s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 20:06
General
-
Target
e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270.dll
-
Size
1.2MB
-
MD5
5a0c4c42f5e08a8c849585c2e879144a
-
SHA1
510fe0f87805421371b01665c7ae5f99b74826b1
-
SHA256
e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270
-
SHA512
2511f59c1e6fcca80327d870dcfd4c76bc9b028956fcadab17fcf7d052b6118d5d672b5a26c6db2fe5c4e23279930c5baeadc72e1e427a8cfcb3600cf2a23f8e
-
SSDEEP
12288:ZPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK85rQsy:ZtKTrsKSKBTSb6DUXWq8is
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e881cf10644b85844c12cdb53cd3e5c26776b7248da85c031373ed11eb030270.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\i4QczkT\WMPDMC.exeC:\Users\Admin\AppData\Local\i4QczkT\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\xbPaXJN\ie4ushowIE.exeC:\Users\Admin\AppData\Local\xbPaXJN\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\OHbr\Netplwiz.exeC:\Users\Admin\AppData\Local\OHbr\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD559b2a24c4e4a1d1faf4ee02f77bd1f76
SHA199786b259b3c8fd6d168e0e9b157fc516549aa8d
SHA256f07d3926587d321ea3217818ff50521325293907c77249cec78ffa1cb6563751
SHA512f13a970c20a7e095f5924eda4ff0795706987e988183efc487694fa3e5ea0cabd690b278dc09ef68402238ed81f37c511d047be090e803df769056ba7add58f4
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1.2MB
MD5b0fbed9b9e237035067824e5d598aae1
SHA163533cb10776344d34e7ca15809ee5677e07af2c
SHA256d80fd492fef66cc32aac461278a0ad0574378354a4e29c64bed799bdd21de7b5
SHA512096e38f5be2956014cbc60d77190a0265db4c5f84bd31cb9adc904ec47abcd6b2e72df168dd56e3c37c85e364b5d340e05a820849960521c3c6d5dcb2b5aee4d
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
1.2MB
MD5361223ae615a8bf7889fde36bc0da7d9
SHA1c5276c712968a7391687950d5741aa92a41b171b
SHA256a22197f4c367877a6f60c46a575b21f4b2d2b930a8f269571067053abbff208d
SHA51224c76cc611636e3a7168e38ddece7d46cd3b0aadc9b0007a6c5701b47ff3e0b55baf944f8e1514afa8ab1940616a286fec5a75087d952c49e914fd53fed33bce
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
1KB
MD5690c236a14f67abb1a0ca191e3994e68
SHA1ed64c9c657ff4648bf40622d2bfcc465fe68b598
SHA25603f7fc733a9c6c6ef0f04c6c253fcd74809405c61325564fc636458845c076c6
SHA512f8668cec60ecbf9e2ab8cbdc6ede66ebae666e3a3caa44b2f73914fae1e73313c4fad99b3eab0319f23beaa00e1386d66c45394c2729def2621c39973c8a827b
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB