Analysis
-
max time kernel
149s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
11-10-2024 14:12
General
-
Target
1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020.dll
-
Size
940KB
-
MD5
a0cb297fd3181bda59066db2281fb496
-
SHA1
7ba6d4a54cd899bf575da748def486be7dffc70d
-
SHA256
1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020
-
SHA512
3ace28434cf67dcda52b3f6f7bacf03f97e92d76e4d0b69f9e3759c50f0b236f0e673b396a2b255706864bf25409212eafde50ac6374155f2c15c856bcd87390
-
SSDEEP
12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\SSkorr\slui.exeC:\Users\Admin\AppData\Local\SSkorr\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\kOQE1O\dpapimig.exeC:\Users\Admin\AppData\Local\kOQE1O\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\0ak\msra.exeC:\Users\Admin\AppData\Local\0ak\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD548ed7aedc6caa751f504ac8c44c83eeb
SHA157697aec4fd08705683bc737e00d00dd494c9b21
SHA256540046b2dcf365caf14bc52e9aaa1f1100df9dafc3d04221f8c5a1f98a64b9d5
SHA512988185c89fa24b92523380abf5cf0fc088aa83cc7f91c589c178c56bc95c70b278b9b38ec6c589cad1a553e38e993fb5221b4d8bfd08359507d0ec9c849e0e85
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
944KB
MD578843ed86fc755b000ecf8e5f98bc672
SHA193e8c05f5dee5cecfc61522ad4f66790a61c49e1
SHA256809f37a1e67498e4a65ad68db8d6a6c2ad2872c4f20a897aad87e119612f6d04
SHA512d3984f130437cf3cf58d024be33f4e2a0fe8cec8f18a020b37b60c4e3a628813bd34d4d49cb6bd95230c77089112ea9ddff7e90299ff15a096d76ed7978b65c7
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
1.1MB
MD5a7eb27e7f49dc292ce30254511f2d587
SHA13399c4fd68f8fdbb7a72ae874d0577058f5d02dc
SHA25611d40c5dae9fcaa5bcd60c9d687997c5926846a14894d62616d1222176ce256e
SHA512f843c3ae3da1247648e73a7f44484af152a6907987c1ad3327ba2f65b42e5fcd658a94e8da48f09c477453c6f7d88bdf616b53066f8a0d9ce8ab1927c20ef391
-
Filesize
1KB
MD5f9bb7f3f218d3982ea7e2fe0cc37505c
SHA137ad977397fe649005e8d76696f1e43f86e0ecab
SHA256364593f430ee017a959399dbd904bbdc8692ee2c2c067d1133d3be1ec5740dcd
SHA5126824773adb6923e6221c2d2d18d63e39f8e141cba4ab4d8052657edff3ab318ca1aa7686e421ff22db1205c656cc53e80860af2a42d43735b0075400f92e3602
-
Filesize
73KB
MD50e8b8abea4e23ddc9a70614f3f651303
SHA16d332ba4e7a78039f75b211845514ab35ab467b2
SHA25666fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1
SHA5124feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB