Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 02:14
General
-
Target
2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll
-
Size
936KB
-
MD5
bfcdafe69d90bd7023f8ad9a3010387e
-
SHA1
7fa6a02a6a2ded8ec7146ea384f61c9fa0dd783d
-
SHA256
2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073
-
SHA512
1a5f3d120c40656d9b8d44f21afbe4841426ff12c0b72e9ef9f493e2c519ae430bd631e3da7cfe90afe8c50e6096215d4dc898044f66922123f210024f46082e
-
SSDEEP
12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\0Jjsmdp\slui.exeC:\Users\Admin\AppData\Local\0Jjsmdp\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\FHiPrXxC\wextract.exeC:\Users\Admin\AppData\Local\FHiPrXxC\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\phoneactivate.exeC:\Windows\system32\phoneactivate.exe1⤵
-
C:\Users\Admin\AppData\Local\nfMLM\phoneactivate.exeC:\Users\Admin\AppData\Local\nfMLM\phoneactivate.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
940KB
MD5f429f758c9abacba5ab2886f75d5f707
SHA1b46f067ea664c392e6b6c0b38d309435a26cee5f
SHA2565acab9d2b991c9fbea87798a5a3c1dcfd53c42d3916acd48d5430e64300be42e
SHA5128cb2c399f16d7721c449ac709425fdf32dc0c7a9554992613a6f165998e6b93b7f9f17f5508aa5fcfdd0dd1d897130a73649159a6bb95a7bc3826f865ed2922f
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
940KB
MD5e782ec7ad94372190591feff6a990bda
SHA14a4201c0789ac649e3a241f2824fe6524389fa2a
SHA256fc02035da7c826126fa95d11f7a5d772c4b842794f711b6aa2cd86a8282ad89a
SHA5125db9c0363b59e913bb075acce90f4cf49074f33fc32a679a0af358338b0ed1202a13ed49afde06703e3426dafb22cd23a3879eaef8be0e4e4b1d5d568546ba4d
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
940KB
MD5bd8491f6f413ca3c629f69f8d5fe6f9a
SHA11b86e44ee25f6be1abc116602f563d579f5ac887
SHA256571b690a474686d07ef6750b7e3583b867a6617177cc611ce2e80cc0b6cd26dc
SHA512dfeb29817beb1a3577516c9b590f64e13084acbe2bff87052ca2a8e5fd0bd67fded7d056d831ff48078f3eb31b1460f7e9871b090aaa86055cf341a5c2b8d633
-
Filesize
107KB
MD532c31f06e0b68f349f68afdd08e45f3d
SHA1e4b642f887e2c1d76b6b4777ade91e3cb3b9e27c
SHA256cea83eb34233fed5ebeef8745c7c581a8adbefbcfc0e30e2d30a81000c821017
SHA512fe61764b471465b164c9c2202ed349605117d57ceb0eca75acf8bda44e8744c115767ee0caed0b7feb70ba37b477d00805b3fdf0d0fa879dd4c8e3c1dc1c0d26
-
Filesize
1KB
MD5dbe282f009ebd26d01d47cfa00b967ee
SHA1686b17b963b25d045216cd56b918915a03cf87a4
SHA25604cca09f56256c9d2d0a3499f3bcc6d94a1ae4db49f8315925734c34e7fd1808
SHA512ab08eb634774c3a35ba5752961cf8950842af2c6504c996d1f0435f4425065a8c7993b6d78ce75a951d58324dd2058a2c8adbc98f57bc565c701a1face0fa313
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
940KB