Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 13:06
General
-
Target
7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544.dll
-
Size
936KB
-
MD5
e6080347ef82059989855367f707b6f5
-
SHA1
af2f5c40bdd1b55fde1fab97d91e5e7e12733731
-
SHA256
7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544
-
SHA512
6a58fb67a3cc61fdccbe8335309964d1c2d2cc9db2d1e47797fa0ba2de69631f71ba4499e9b65d921846832f33e358356ac917f836616d6a0d08209767f1c82b
-
SSDEEP
12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\RM6L4a0\dccw.exeC:\Users\Admin\AppData\Local\RM6L4a0\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\f4FjAmN\RdpSa.exeC:\Users\Admin\AppData\Local\f4FjAmN\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\1q3aNsSC\tcmsetup.exeC:\Users\Admin\AppData\Local\1q3aNsSC\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD5fd233bdb42408e9f0163e7c366788808
SHA1cf91fe0e11070d0a45175cd9b4cd70b22e2fde38
SHA256a1826e97ef80dcb97330ec0edd5580735cb216b1cbec5a65bda07245ff26ac9f
SHA5122ca95dbae4ac37b3073782bcd7262911300d7502ac5eb5401787259531e8087feb34d8dab6926c4af7db6ca0bcbd38e2cd04d6281e0d666250aae044b3e83b51
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
940KB
MD5d1cf3d2c11cd61607e2708fe1a1d1002
SHA1dae881347fff15d936e87f4b18d4512aebd15b4f
SHA256693dd324144acec8382e9ee1f4b2feab16ba7b66fef9a42b6fda7ba198aaf55a
SHA512cf9777e1527b9e78b9eca56d6afcc7645b0eb7b41a0b9e134c241bee7ab66799a7ee925e197584ad976f6c63a7e314ae2eaa68012aeec068f86b63caf0ad4035
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
944KB
MD5ad49aeec0c40d985d62a5b84cf73f362
SHA18ba255b87940a6ee67b53f10ca33d29df057de39
SHA256f05d9c1621eb39dce8636d2478e98e919114289fad053e9b9e7943e20bbf1909
SHA512737f81cdd69c751a23d3bd727580713ec32839429820e56f8a47ac0ccbdcc3e006acb093b65b14a8f81dcef055e1c35b3d4ae975b8bcad34d346df0025fa3741
-
Filesize
1KB
MD55e3dcaf6ca3d22ce043b83a8e668f692
SHA18ab44599ac3bac66aa1bcddaf478ec7b4b7dd767
SHA25624eabdec0cd578ce971d95a1e499652e21148d5e67926389720e0ec393e8109f
SHA512325e0132129337e05d4868e9657ed2ff45251e3528b2a083afa45be34abc9f3f32d0b576d404cbf376b2c1f123cf84bccda528abb5e82bdd5daa9c9b302b2a1b
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
76KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB