Analysis
-
max time kernel
149s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 02:06
General
-
Target
e24980b28ec5594c3d1a3d103fd47d1b143d0af8c5dd1209c05a92c5253a5900.dll
-
Size
940KB
-
MD5
e0b9356be4ee72141b4e5a8a3f3b6073
-
SHA1
053fd016717cb83924ae47970d162f6e818c5231
-
SHA256
e24980b28ec5594c3d1a3d103fd47d1b143d0af8c5dd1209c05a92c5253a5900
-
SHA512
45d8c614ac2a5872755b3e29f432c7b3eb07596c4acb07d3212e26f0f5e6746d5c32f0cc8b70966cf4a2d28c4bce1afd9c3b7d8a1c0c6d2a52313f9664a02874
-
SSDEEP
12288:wPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:wtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e24980b28ec5594c3d1a3d103fd47d1b143d0af8c5dd1209c05a92c5253a5900.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\mL4v9MJhh\SysResetErr.exeC:\Users\Admin\AppData\Local\mL4v9MJhh\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\7DU\osk.exeC:\Users\Admin\AppData\Local\7DU\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\bKBWlmDgB\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\bKBWlmDgB\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD5120034369d5d7da506ac3944f0b9328c
SHA109fe27900193a74de00ad385b48ba666b663caa8
SHA25669194464184194fb8332406941757e8f62a77b15cd3bbd413508a581cfe2464b
SHA512fa249cf20d2d4d34d156fd52c8910f7f8a36db93426813da6942dfbdf7a8aa374171aaacfbbfdb1cafe074e1cdd7a559e7330accf2f9b37abbebb5bcb9d223fd
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
968KB
MD5275646a2d128a6dadaecad92352b251b
SHA188e6ffbb1c6add8b4a189bf2a7328666ee235471
SHA256141b8931dd99f70b797705ce0a8ee67de3802dd3ddcca3f34f822aa175a7d23a
SHA512e171b47c0b0da8c60f36ffb9848391aa5c67dbed1c8e26e57c44b875d46e851e6cdd70a3e7ef41100f2a9f4da41a99149bb26981818c973c3bc66031fbd4f684
-
Filesize
1.2MB
MD5dfae0d3d0cbc90b97eebc4dbdcfdc6f7
SHA1d1ccd9863b1e4606a7234fd78ec10f8cebf81384
SHA256818692c00d2a5c9c3aaa06a7293bb6bc1cb24810545e44cf0c6e690063e77103
SHA512f82d5e350d04d08bee590a0f11f6c9a482ad4b5c1e80c93c110e94c300f97fddcc30fdb2fc1c00bdc83b3f6ed2709d01e14fcbda685a36acf897bcdf86bb5352
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
1KB
MD5bf669e55bc2df29d6585fc0bcd4b56dc
SHA1db308e8f239b50d375fdf1e792df627b163786d2
SHA256d532d74859d92a79ca255686a8634915434b603b49362a00ee33e87904b7d4ca
SHA5125681d65e6f9394f0a03cdfc61509c285750d442ab4e3561f3cfb9666af7a7bd9df5078d8aa5811f309ea0b2c8e11f6b26f65e82c2a70bb13fa3fdca952d11a69
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB