Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 07:10
General
-
Target
525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40.dll
-
Size
1.3MB
-
MD5
f84b2da4a842d7b705d104df3ff1dfac
-
SHA1
bab36606ed69758eb3dc898583529bb0f6d3b46f
-
SHA256
525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40
-
SHA512
c91d9c63d5e95a1f2413a7236fc1c70a6d406c9b498740eb0d0fd25d1a568a17bef6bffd1ef724e2a553ebfc6f330fbbeda92ae837191e2d6967154ba957a7e7
-
SSDEEP
12288:xXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:NB/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\t0PDs9mMS\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\t0PDs9mMS\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\JPQU0\eudcedit.exeC:\Users\Admin\AppData\Local\JPQU0\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\DN3L0c\mblctr.exeC:\Users\Admin\AppData\Local\DN3L0c\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5e6b919dec1ded15907b80d273e2765f8
SHA12ac860f97fc7edf71e629c14af028f618d0fa98d
SHA256787cc8eef104ef8d59387dabd4139b2816dc1159754113c914d6bc8a1337f092
SHA51281615933573b98924e0a90cb06f0f42746804d3ccf4ff78001831b1d1c7e32ef2e368d0ac15511c8af2552870dbbb0e82ffcc31cba9e83daeee25dadae05a57f
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1.3MB
MD5abfcd17d6c1953c0249047d15daf7125
SHA1011a0feeac69a2fc696be4649b4105d0cb8ec300
SHA256c9aa473071dfe307d6af7d8c7a5abc04e552ca0c0dc3c4cbc72acb22178a0f78
SHA51228ff7cb006279fb33d3daa053af0e44889b7233f2beb6f0d3915390a038ffd913158336f2c272e77a4ae2ef5f6883ea7ef546876992d1a517c6dcd4f8cfe431f
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
1.3MB
MD56ee372d94b086050cf5b35a481fbb235
SHA197154838650450db0f52f9896181419a6177b38b
SHA256b33c0bedc4836fd31b48365d880f061fd0be62523f95fa1b4b693425ca8ca26c
SHA512a0b36553a40a5432282b4f33685851c0e011561b60c8bdcb521405801461b9869c3e1dbd6d837d7cba4ce55cd3fd54c5ec6b3db0f5849c393bcb1a51c83e020b
-
Filesize
1KB
MD586749d24177ecc4e99d5e4d684f4d91d
SHA10164ebaba71e4f0c73f7406e6a4b03b19a764c39
SHA256cba820ac354f8c7826b67261f54d4099da436a65d7cc3cc6718488119ded9255
SHA51284f31ecd75689b7ba52c97f05ee7b9b1f40467d5834431131a3d52c0668bcff242a36f4f765341fb4a965fba68406eae11eca979e2a9f48591a3bde6443e2632
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB