Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 14:20
General
-
Target
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll
-
Size
940KB
-
MD5
33542753fda57b6a2eb61fcf509298d3
-
SHA1
ae14ea0f0e01de7ef2f4ff2e60361f1065853616
-
SHA256
9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3
-
SHA512
f664c54e9f1efe596219f4abb442d93eae6723dd377739323b619d229b4d8ded802c6b4e5a22227b8498692a4faed9c83bf4e5b82ba1e1644520140b18c6eec3
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9a98089a9a05bf0abd6ba54247893308568db62c77f15834cc0774b8822429e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\8GNoOE\recdisc.exeC:\Users\Admin\AppData\Local\8GNoOE\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\Eep\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\Eep\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\VlN7i2\CustomShellHost.exeC:\Users\Admin\AppData\Local\VlN7i2\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD5c29deccf01e80e89f2c070a0719780e2
SHA18c174031e7297e6628c64ccab6468fa2d4ac7919
SHA256dad70a793428d1ab65d01292272d00aaf57adac4949462257a8323d84652b6bf
SHA5122603714591920545b467a08f8f4f27e960edb0463400d40667ffe24e5d170a77dcfd46c0e2b00c0a9df967637675f07b6638dc2102e582bee0e0543a2cb5ece2
-
Filesize
193KB
MD518afee6824c84bf5115bada75ff0a3e7
SHA1d10f287a7176f57b3b2b315a5310d25b449795aa
SHA2560787b37cf197595b8149ffe3784f9c59eacde3616011f185513ff5c075a5ac4e
SHA512517356165b401dbebf15437d3b17746aef5a6a4cc62a0afe45966abc92b4cf377eee4514a36ee28b1e88e55a22a2f8a6c997df45971e7f354b66ac7d9e141845
-
Filesize
944KB
MD574816628d0c2dab398cf14e4cfde3114
SHA17a39aef01ccfd4b69dbbe28c757f4c6957e9ef4a
SHA2562c10e8f6752e66747e42388e0deaa44c50a752d2e4a1dced61ba86435267a0ea
SHA5123b8dbacbce8b83e6d8f1e0f3a40124cc7c953d180ac0e01750f75bc5c538fc10395f323543320b9a9643f363f515e74516b87313976620c14a5fbd79e41fd44d
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
944KB
MD5cc3a5c55eabfa39d79d7acab0781de7c
SHA1f946b8c7259712bb1ebdd2dc39116852e3640603
SHA25615718b4e82d2c176718f419c06fa1e70bac5e17d3440dcacc49c698956d7cae8
SHA512ea458e156c29944ee1e8329a6b2f5c5877cb6ce7e4a1b51e0779aee718cb8ce3ab1f91d95f39f769eeae3a08108f7aa51e6b83800566e431aeda115a0c1a0cb0
-
Filesize
1KB
MD5f821e9ada2ec37f3a24b902f810c7792
SHA1e9702cc7f595580794d0ed401635747713050ec6
SHA256e77c146e3e855e9cb9a06f8e2f8e98a636b0e6d457ac6ab2d8fe3ba7ed205c5b
SHA51265de98392336431c2d3e5f62f62cfbb6bb25148b7f76f9b358a6b22904e398831ea6c3c3a9913d9df60ed419830f17498842cdacd2a7fd6a28e82d9590805068
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB