Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 16:07
General
-
Target
dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88.dll
-
Size
944KB
-
MD5
dc4b3d40467b02484bead9b93e12862a
-
SHA1
2fa0d80d3ee72fbbe3a4c35c8ffc964f47449b4b
-
SHA256
dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88
-
SHA512
de790f5c7fe3f32e19ea7eecc0d6fc0476d95dae957a06fa6b4a409c5f421a37d50d788787558d99496ad26590209bc226257bb9b0916dd6bbe0d03413c53286
-
SSDEEP
12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\UyycDT\DWWIN.EXEC:\Users\Admin\AppData\Local\UyycDT\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\qbu\cmstp.exeC:\Users\Admin\AppData\Local\qbu\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\SHemol\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\SHemol\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a14efec3462d5ea1a69869ba3d7e116a
SHA1f5408e4d49954ab2ac189a46d41e8833b64e1284
SHA256dbf58269711c4bcecc34df5ce1568a467bf43bda3ea25f909fffa0c9c5ff335f
SHA51291c55144bfeb112e589c366bdabc257a4c19ef1de62f909f915ac87a883dfdecd7bd0f199e1aa7b868a8ce985955f6cfc9291a0f55e33581292e147162f03fbe
-
Filesize
44KB
MD5591a98c65f624c52882c2b238d6cd4c4
SHA1c960d08c19d777069cf265dcc281807fbd8502d7
SHA2565e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06
SHA5121999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
948KB
MD5a0b8a9df2f810cf0f198723caa090dc4
SHA1f3d03ca9df5e8f052f9b073b8d30702ff8597e96
SHA256d8319b1385ed6ff06783842a449d10808727ea4bb9c2827b579826ca58bffabf
SHA512a85cc7fb169a2b8ee14ae9cf7e1b530cfc950e037e4836b90c8261e53c893baab294b05b53f4ec35e8c8e47732596c7035f626d37c414ca65066f94501690d09
-
Filesize
948KB
MD5572eff100e39b0f07ea433b5e82aab90
SHA1d5899676ccdf11eef72c5e4332f6897f1f713f1b
SHA256095f427808b54988d33d68787dac0200f4752fb3c0f8cf4b5ddab8d1f5008feb
SHA5126a076ea7ce40a340505c2453088515a9b074c9426dd86743d863710f0f71b428142061216ef3222b77fbc7529b5d8a29efc960ef2c6ad79386dd93e416eaf4fa
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1KB
MD556f8ade44391bb33af0fdef8ffaf7cac
SHA122f8c939454da87e6cb4a00dc80472dfed04510d
SHA256439a0efcad14fb7d4cdb0c1347d0da5e499ebb22f0f987655e982ac21acb45c9
SHA512ce3fd25450c98cd047726644fe9ac07c2e708fb263ccef7dc3754de0823dcaa46630cbee70e2334fe3885dadc31a979ab5900da66c6d81d564e2a2962013f8c3
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
28KB