Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 14:12
General
-
Target
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll
-
Size
940KB
-
MD5
33542753fda57b6a2eb61fcf509298d3
-
SHA1
ae14ea0f0e01de7ef2f4ff2e60361f1065853616
-
SHA256
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3
-
SHA512
f664c54e9f1efe596219f4abb442d93eae6723dd377739323b619d229b4d8ded802c6b4e5a22227b8498692a4faed9c83bf4e5b82ba1e1644520140b18c6eec3
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\pK93\msinfo32.exeC:\Users\Admin\AppData\Local\pK93\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\oHEXjlGE\UI0Detect.exeC:\Users\Admin\AppData\Local\oHEXjlGE\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\qyCjWB\mstsc.exeC:\Users\Admin\AppData\Local\qyCjWB\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
944KB
MD5bf41245ff0461d2eafb2595275716e38
SHA1e873311aff0ad0f31ec0545ce8f500c9eb5939bb
SHA256777d0f04cf5fc8290e436dffcd861ff15252d7f2b8a5c275cf2ab4d819e17882
SHA5120dc857af0f97030ffedce6ea1864c9b75ce67641d6303d0f1f31b44645a3df2341c851027b40e782ec52706c3ee0449eb1049890df72add597ee1f6324a07fc4
-
Filesize
968KB
MD5b6501afd889c799ca89ea26f91f5d407
SHA1d22a3bed0e340fa77c1397001829abe3461ae991
SHA25629aa0c2f2ec7b0e0b7e40f25729fdd3c80ffcf3c13d41ca55f9d2e69e5e422d3
SHA51296f13423973be0b76fbd2f4ff2aee7cf11887bf7b7e4fba5b5bbbe0d826e8aa02d5f474ea422e9d911a56469fdab819eceac8dd175fdf64d7f2188272c2f07c1
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
944KB
MD57cdd2166946e27294e5aa9e4df7d9195
SHA1eef62dc45bf0127b9d69e4f7ed02e4e92e4a156e
SHA256d7d2cf7a369f4c0ec7a6af5c0a1f0e4406cd47d85857532b70adf1a4dad5d787
SHA51280e0c981db23e8ba39ccdcf15a7066f52dcf6d8113cc2f34dd171519282f206431c359e37cf76048eb808fa87c72c64b01c632149911bf5a7e2d11849d44b978
-
Filesize
1KB
MD535e7dee4793a74fd5a10b122c4c23c8d
SHA1c26ef21d03ec6afa344e641f164fc1cfffbbc4c6
SHA256ecca14e8564df37655f9efe5ffa56252d0389357f62b15bbb87c11b871f3ef50
SHA5126908ab66e6643562a63c3f1b0d4dbec9e1dca16ed4d468a71bca08f11526504dc4f8c1ed005a38045eb857057a463444fb3e33be7eb3e95fcc666a9a458acd8e
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
28KB