Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10-10-2024 20:09
General
-
Target
0fe4a1f561c62db783b0319724978bd87d6cd1cb2160c21cee7d6332e6376cb4.dll
-
Size
936KB
-
MD5
e3131866f91556ad080fe2a779aa1b17
-
SHA1
df96ad3471403e2b98e66b15851280ea51e13291
-
SHA256
0fe4a1f561c62db783b0319724978bd87d6cd1cb2160c21cee7d6332e6376cb4
-
SHA512
288e9f5ce7ea185db87f0034cc39409c7d9fbbe334e6b71da5569d02d207103a343513985e15286771b841faaccb4bb5f4224bd0419d24d7967f65d71eb93d89
-
SSDEEP
12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0fe4a1f561c62db783b0319724978bd87d6cd1cb2160c21cee7d6332e6376cb4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\ns5t\sethc.exeC:\Users\Admin\AppData\Local\ns5t\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\LLphxbdZl\Dxpserver.exeC:\Users\Admin\AppData\Local\LLphxbdZl\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\QwlWAr\sdclt.exeC:\Users\Admin\AppData\Local\QwlWAr\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
940KB
MD5998e0bcf9d0a88c9a5e6e6a838e7af2a
SHA1a3fad940f7c2b2a910061273894acbc631c83437
SHA2563cfcedf4bff970c789d87c482aa8aad34f08d0ef79836297f1b2ea5c1dec36c2
SHA512dff582ba09e9a657c272fe39e3dcb416d4f7c3bc2a75c929e5b888f8a27904aa3d3eb2c5ddb621c14c40b4eb2aac0a17ca3fcb708977e22fed0a44e2bb1c503c
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
940KB
MD561431dcbfb10700fcd58625449ecc4aa
SHA179a5c455c79c2be62b52930f468637fe1727875b
SHA256dad962ab8cd3020bf143b3b0456f46ed9eafbd153957da18b62f9a6121f5f5b5
SHA5122e229cdd20858602be165de98623fd92a697d4c4c8c9e0b0039e4706b74037203639ce6ef2fa885a703cfd51df0e7dd9c8848d5e03a917955762662acb726e77
-
Filesize
940KB
MD50f6175acfb2b37901cd41feccc9cd57b
SHA1baeaa81be2ea4ccae8f4fe66141008afe2005ba7
SHA256df52d7ec686605562bf9b407edddabf20e145d54c334e4736b812a6dd35aaf01
SHA51278b593adf97519ae777b72706a565f780b0f8a9b2254659d30c9f5691d5a8c67e54c0e2605e10863860755ceaf9d83dca4dc6563dc1651a13d4fc5a58f729f6f
-
Filesize
1KB
MD5a88a47b9d9a44ac0ea7583397153238d
SHA15274a515ffe0c2952a31ac373959bcf3bb050458
SHA256b32c951020fe7f20f4382de87536043ceae470d3243bd8ddd54e87b4daa7e4c0
SHA51266bfd2f6e02474ed313270d750fea7f1698c833e0cf0ceeded7aa75a3efa1a0cf425a1badc60738b16ae369277b19fa14f53b5746c24c8c2d0e7e9b24ac9c44b
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB