Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 14:12
General
-
Target
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll
-
Size
940KB
-
MD5
33542753fda57b6a2eb61fcf509298d3
-
SHA1
ae14ea0f0e01de7ef2f4ff2e60361f1065853616
-
SHA256
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3
-
SHA512
f664c54e9f1efe596219f4abb442d93eae6723dd377739323b619d229b4d8ded802c6b4e5a22227b8498692a4faed9c83bf4e5b82ba1e1644520140b18c6eec3
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\zrI2d4mR\rdpshell.exeC:\Users\Admin\AppData\Local\zrI2d4mR\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\9bExE\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\9bExE\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\1XuF\dpapimig.exeC:\Users\Admin\AppData\Local\1XuF\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5c486787dc8a6c2da70ae7b5c0d561116
SHA1ee3c3b7cd8725756421ceaedb2037a3e980eaa88
SHA256540fb18233ba78d0af9bb4e2db3f4756b56768c9aff88020426a7a0c947ea8e6
SHA512994ce2be2609fec2409416160d15d3e2404415ce661ee05473bc7407787f8eb51ecf77c1e8d73285072c01866ba92922dc213959c0e91d9dc001a492b4ec0449
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.2MB
MD54c182d74d40f2ada08f8e5f2d11bad29
SHA18a68a3e6e5401410504b99bb18ed32983beca26f
SHA25660cb896b3fd3a3ea7bd23736bd2c62d7ab979df5f44150f8a1e4fb4bc790eba2
SHA5128e2adc81fbf0d9300dd3827a37bd9ae7d89600b40f2ab0d0c186448933e7418728e0c00a332bb0f8a396ff92f1222064a96d8ca96c332c3f3683b4513e53c7ea
-
Filesize
944KB
MD5da3ba3d0103d4e5f3e17f7e418098da4
SHA154f67d25b0dc35c254f2a13d9133adf08879e4a4
SHA2564bfdffe9bc0568f57816ce0eddeb330db0ca5220a6d3071c58554a57ccab887d
SHA51204b6f5b837eb5bea8a94fd30df4eefd79405429ce5b4d372f739f76f9b5e08d0819bf39c2204673d31109b4a033ba860544f3988ec60ab1ddb963888ee2d31f8
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1KB
MD52bb8e267da0368ee6d0af968263f6b6b
SHA1bb437d4fcb3f23ff9d0411d1120baa6f2c202339
SHA2566749607c7af7bdca2b48a36605ae6495996f6b5c4cdf7cc9c28eb988da044009
SHA512220caec0b2ae25fa32a36cf5153235af747e02c8f8ddcbd18bdd2f1c6d23f848274965f04e36c3a754c0ab46e51bfff9061ee66939205405931201fd1b392dfe
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB