Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 16:13
General
-
Target
9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c.dll
-
Size
936KB
-
MD5
8eef978c00b27044f919df7c554d5520
-
SHA1
cebd31232222956453ec07290acf6acd42bf1ba7
-
SHA256
9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c
-
SHA512
1be501d0c1770bc5cb35ef26afb8d7670983888b2d7ce9ab26b3cbbd9d9d582437111ec43b060d6b378df3af9888501e81f03b5506d13e775ae2172d3d84bd41
-
SSDEEP
12288:bPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8y1:btKTrsKSKBTSb6DUXWq8y1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\3nrmMHk\sdclt.exeC:\Users\Admin\AppData\Local\3nrmMHk\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\IoeYpXN1\winlogon.exeC:\Users\Admin\AppData\Local\IoeYpXN1\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\a3a9\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\a3a9\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
940KB
MD5c2b592ab8972b3c4f1f95da317bfdfa5
SHA10569b91f8cfcaaee4d7b4593a222be6561f431c8
SHA256015d9eadbc67925ec53efb9f3cb6af502e46d1432fba7967733d9d1e3bec889d
SHA5126c6bac075aed3308802156d9dbfef661fdd2315ccd6cc6b1cd339f73d78376f2b88d973f96e45755a86be6ed63618409e1e207b8e101f5469f0fd77fa351afcf
-
Filesize
944KB
MD5ccd8deee7120c7c744a45ca7165c89a8
SHA1591f3f8a12b6cca1692e8bb156248f7eb5b75a6a
SHA256badd4f50d8ace27e5ff0d9cbe70cc591823635472fa181f3ff5336bfbd605ad0
SHA51201653c91e17b826e266d7858fcc1cc0eefeed61fc782ea53bb9beb84930e8dc8a9047544ed4fa083d6c1dcc1472a3fc9803e3730b472372f7e4ee491fae6e192
-
Filesize
940KB
MD51c543ab352fb959f2f333c36b17340c3
SHA1d0dc3d447e9b8f5de720ee8ef9aa7df7c608b311
SHA256f8a5363b900bbb415f83c1ccc75dbf5ae73edad070c76b0d514a80c43c0cabe9
SHA5120c71ffa16685cefdfa4f533d75ee766273e81085b710d221e424d24d3b066e26cdd4c7d9238ac413b60ac1fd6d5a2c1cc6d110684962743f7eb233c068036302
-
Filesize
1KB
MD5367e33ea53cd30ece067ad07eb421cfb
SHA16f3cf6b1bd215e6a5a7ac2d5ebf8ce89a8d2b163
SHA2565bdda9879c8a75db92a3067151b0ac1443bacba0ba569f6e0b68b52b85c954cc
SHA512b59a85ce0d3916a88ea7c30b191e7459fa6704ea54aba5bfa7d3df0cfc7b756fd2f7816817459645ad31ae9385845b5d341dffcc80fe934dd9674bb43c1aeeb1
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
8KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
8KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB