Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-10-2024 20:06
General
-
Target
299ca619e685fd6048d3e32a1e87442a7c0452851d0a10d1917e9599701d95cb.dll
-
Size
940KB
-
MD5
f31d12c6f9c83ee5bc000f73237d823d
-
SHA1
9524ee61a2d9bd0f246ea128226d9b06ff4275d8
-
SHA256
299ca619e685fd6048d3e32a1e87442a7c0452851d0a10d1917e9599701d95cb
-
SHA512
8b59d757c0f00e6c65515bb1374f4bccd20e419ffc5c9b19ca90e275d4222bd9f53849cce7e349fdb03bf2092beb3b1321d7049662beb95a4bf5fc503ee6ce90
-
SSDEEP
12288:wPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:wtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\299ca619e685fd6048d3e32a1e87442a7c0452851d0a10d1917e9599701d95cb.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\dnAir0X\tabcal.exeC:\Users\Admin\AppData\Local\dnAir0X\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\O4wIb\LicensingUI.exeC:\Users\Admin\AppData\Local\O4wIb\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\zJAAVmqa\mfpmp.exeC:\Users\Admin\AppData\Local\zJAAVmqa\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD52d30b7858347cd0f7e821f4bb719c6a8
SHA1c382a59fe65d9018db4737211989ad6ff472db10
SHA2563fb65fbfc1fcd5b3bc0d622d5b8b5dcd0a8c25281ddc74eaee6ee34b714da1c3
SHA512fdf1658d1a68a3380d3abeab1ac22d89b4712de2929f305c247df23ce042238c40d6386ce0ea316169f00098c0ef7d838e47c0b17d12cc1e0f408849373bae57
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
944KB
MD5d2e3ee7a1be791bae0d04e4410c03e97
SHA145e7924d2abe8f6e71b291fc125b435fc25fc5c9
SHA25684d8e5e27f6acab473d4db0a854b63a2ae7247dcc711531429cb960b04fca8b8
SHA512af1c656af85ffff88002d706765dfe68a2398b9100ecb83a5566ad05b015a72868181ee9f87826cd2be09ddcbefcf05aa2a86ed61288882903bd184a277f938d
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
948KB
MD53fdabf14b6e59903557333a69ec98337
SHA12868ee94dc7d338667e2ba123ad917405fe0e587
SHA2564e0b4bc0f5d573dfa76c0e643e24384ebe5f4bcc676243aee3af06f8c51b22fd
SHA5121867950b4bad8ad7252d1968781402e32caf649e0dce0d6fd28714ed4c888f22e7c9e56649064dea7e8118f202b747c4f041f9f2083a82d80324a1785b800118
-
Filesize
46KB
MD58f8fd1988973bac0c5244431473b96a5
SHA1ce81ea37260d7cafe27612606cf044921ad1304c
SHA25627287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e
SHA512a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab
-
Filesize
1KB
MD581867e246963a7971e86ab889d0fd1d1
SHA1b95b596ac6adcff89401c573de2b1a1a66841088
SHA2569a2aeb28272805923b6202839c4f08d35a0fa46dcd6aac1979af92f59d3b7d84
SHA512eef976125224d70f204cce8186ea8ce158bd7be43c95963ad83292f05e12ba0a792efe916f4c60dbd8b3fe52eaecda2d49c8553d3b735e00b67d73a2de419d79
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB