Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 02:14
General
-
Target
2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll
-
Size
936KB
-
MD5
bfcdafe69d90bd7023f8ad9a3010387e
-
SHA1
7fa6a02a6a2ded8ec7146ea384f61c9fa0dd783d
-
SHA256
2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073
-
SHA512
1a5f3d120c40656d9b8d44f21afbe4841426ff12c0b72e9ef9f493e2c519ae430bd631e3da7cfe90afe8c50e6096215d4dc898044f66922123f210024f46082e
-
SSDEEP
12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\z21JXr6\mmc.exeC:\Users\Admin\AppData\Local\z21JXr6\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\L9nxjw\rdpshell.exeC:\Users\Admin\AppData\Local\L9nxjw\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\2BUEPwZKn\TpmInit.exeC:\Users\Admin\AppData\Local\2BUEPwZKn\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
944KB
MD5244fdff706147d09a04687a2d68296ad
SHA15fd13068e20a0f1e31be652185779f28b7f880a0
SHA256de502de2784f5dc40c1511536169c560ce2a7f06a11a9aaacab73556c76ea873
SHA512066357fdf9dfe650b06795cd80758ecbc9a3cde234686bf067c8aa3a482fab178e21184f061ae73c388c9e7abec17a4c9d46e6108763b0be03b039d3c3b77590
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
1KB
MD57ad50792377b58c5627728dacaf2f67c
SHA15379504fe39f3643b45debdd0b976246e86c1e17
SHA25639ad22310e64073ed021ef2a8284657107b92987c743b2949238784d4a22c44b
SHA512fbd86795c01a374e6f85d73949347ba05e456dd91785840a05c017f756203bdd5aebf23c6c4038a2e2b4bb712bb0ca4cc1272de8901df117a03a49566253113c
-
Filesize
940KB
MD5748f1c9f6bbc834a3051a2291ba5fe1b
SHA1a57d11d0e0bec990292c871df3cd3183f11cc201
SHA256030c0d7853cdbe957eebcd590fbdbf0cfdb24afc4e126737a239feaaac87a168
SHA5120d6f7867f92c191af0e039238ed574229053312feec90dec437026c4032ac9765c00c7977082485aed26e6749a0675243236c6138ffc7450a776a76208d7691d
-
Filesize
292KB
MD5a62dfcea3a58ba8fcf32f831f018fe3f
SHA175f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA5129a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603
-
Filesize
940KB
MD5ba10a65a07b09184bdf2d5a83864b7bb
SHA1abd5a4bacd6d314cc7388fd932f5f85c4631db0d
SHA256b9988d90ea1fc87a6557e57b32c56badd71e769977c1fa9cdfcbd8dca18d903b
SHA512921dde25689742e37b63f7d4b736349b1570eb33512f2b620192f3bd3413030249a1c2fecaf06688efc833e89f910841e6e2e64230fa563bb7c0a0d161396dde
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB