Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 16:07
General
-
Target
dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88.dll
-
Size
944KB
-
MD5
dc4b3d40467b02484bead9b93e12862a
-
SHA1
2fa0d80d3ee72fbbe3a4c35c8ffc964f47449b4b
-
SHA256
dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88
-
SHA512
de790f5c7fe3f32e19ea7eecc0d6fc0476d95dae957a06fa6b4a409c5f421a37d50d788787558d99496ad26590209bc226257bb9b0916dd6bbe0d03413c53286
-
SSDEEP
12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\vmCU\TpmInit.exeC:\Users\Admin\AppData\Local\vmCU\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\ulwYI\sethc.exeC:\Users\Admin\AppData\Local\ulwYI\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\Dwn3x\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\Dwn3x\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
948KB
MD5f0c61f7c57a8655ecb0fdddc0984dcaf
SHA1430ca70f9fada4447b6748ae7ad86fa848fa3781
SHA25625d5bc3cbcb4a478c2b187e509ba8207b8cf45b04dbe0a783076f105b2350348
SHA512ba8d6f8ae42322eb9723273876c98b7d50617988463b832168cba0d4bcf86ffb9c2f34808db1ab6a6a9c720167c581198a608e247464bdf48588b660f25b5a7f
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
1KB
MD57d7e1ef42b19aafa4ef2650aeeb15fef
SHA15d3d938acf45601c53be42addc5b1b185e3b1338
SHA2563b677a6fd5cf908d596cebfd41dc51a8f55173bf410861353f3cfd09f4da9f94
SHA512b4cfcbbba570d91e93f58b638696820386c1370a804da399e34eb4571b2cc26232271c388e36ce16b6e922aaff4a40ecd3fca59ecc615147d6f38b80f2207d30
-
Filesize
948KB
MD594d06e983c0b4e9261b1e369b428ea8f
SHA1e35967d37ba150274344186172908cd23e5d43c6
SHA2566060317df9af82496fb67e759bd6b447843e28b324169fea2a52864db7c413a4
SHA512cfeb81acd1b49df89406ecca411e10e876c050e5c0ab598ff6ae7db538165b45bdf18c8cdabd78a64aea8a2211734738a925a530919e94d5f6ab05ff8c046e02
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
948KB
MD52ec69eb53069d1f6068fd3bbe4b74a93
SHA1d7d832194f97f5f93b3dbfc7592514e9b7ee1f71
SHA256e037494408e4e5110a60e7e80605e8b9452c320116156f75efba05f187689681
SHA5129112d2657ee771180b650d8f37060b7c45d6c42bc0b189643ba6edad2d63d97d5593ddda2186f1d62f85dd246f7b44627ccdcbc58d154968d033ee4002d14ea9
-
Filesize
8KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
948KB