Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 14:12
General
-
Target
1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020.dll
-
Size
940KB
-
MD5
a0cb297fd3181bda59066db2281fb496
-
SHA1
7ba6d4a54cd899bf575da748def486be7dffc70d
-
SHA256
1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020
-
SHA512
3ace28434cf67dcda52b3f6f7bacf03f97e92d76e4d0b69f9e3759c50f0b236f0e673b396a2b255706864bf25409212eafde50ac6374155f2c15c856bcd87390
-
SSDEEP
12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\GXa\slui.exeC:\Users\Admin\AppData\Local\GXa\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\KlD\BitLockerWizard.exeC:\Users\Admin\AppData\Local\KlD\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\KCUwsKI\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\KCUwsKI\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD5509aa5b6143c8e1b6d644d36768ddfcc
SHA1914ab2a56be62b0e8a358b84859ba82939b6b350
SHA256424cdcad2aafc57f9004d7efcf796cd349a6b59eee8cfdda47613593709132ca
SHA512f15f453107658b44ca81c2418a59c6b8f1a17e8c34cdcde86835854d65897d3f507be2303492ce4c43021576b7eaf9a387dc832b982078f7b77268fd1b62d786
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
944KB
MD55534da785d82d6d5ecbf0d5918471b97
SHA1f8e2909ce4466097e1eda04ba38a6d2c11f061b8
SHA256727f71b022ff50a4139e44840660411e4030b065fbe192e478d77a711d19de7a
SHA512ef73bf549ed2f0220c47c2bdfddd3005986f36642ed42822cc17a73daa9f7ffd507d21a31375a95156912dba30ae1036f98e59fe3e3e4f6fac616397ceed0425
-
Filesize
100KB
MD56d30c96f29f64b34bc98e4c81d9b0ee8
SHA14a3adc355f02b9c69bdbe391bfb01469dee15cf0
SHA2567758227642702e645af5e84d1c0e5690e07687c8209072a2c5f79379299edf74
SHA51225471b0ac7156d9ee9d12181020039bf551ba3efe252b656030c12d93b8db2648a18bdf762740f2a5cd8e43640e4bd4e8742310dea15823fc76b9e1c126876b8
-
Filesize
944KB
MD5b4d6101af98777c371a95a3c0aad3d9e
SHA1fd91ac495fa02067be3bbe7d7e1ab4b183c8302f
SHA256514a6d3362517b240bd28349fa70ead62df33448e2e30350017ec1a2ff18d2d9
SHA512579a71a4c78c0856127792f7827127a2dfd47ce9733fde5eb8d812365054d0ddbe50e3a4319ca31f43bcd38ace47dbe363c6d9946ae9f94f5d81dff2044774ee
-
Filesize
1KB
MD518870fafff20e2c2b40f5057db4d0d6c
SHA11d05b67077088c1765c71dc90d6e6f484c5325c9
SHA256ee5b0eacf4fecb04cc9fb43cad49f6092a1ab316e3cd4e7fd70ad0c16c402431
SHA51213ee3d5ba082a6c3da08547abf06b4bd9e1fe9873bc925e2b2d5d4914a6dc7d0984f6f74700703faf8ebf363c2e38b8e45f2847c317f3754e2e4cf8f3feb4234
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
28KB