Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 16:13
General
-
Target
9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c.dll
-
Size
936KB
-
MD5
8eef978c00b27044f919df7c554d5520
-
SHA1
cebd31232222956453ec07290acf6acd42bf1ba7
-
SHA256
9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c
-
SHA512
1be501d0c1770bc5cb35ef26afb8d7670983888b2d7ce9ab26b3cbbd9d9d582437111ec43b060d6b378df3af9888501e81f03b5506d13e775ae2172d3d84bd41
-
SSDEEP
12288:bPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8y1:btKTrsKSKBTSb6DUXWq8y1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9b2a6a5b076828f7f0a821e254c49bf74abed0b9974f3fe6f74414210e71ac8c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\16i\raserver.exeC:\Users\Admin\AppData\Local\16i\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\Wl3l3Qz\wlrmdr.exeC:\Users\Admin\AppData\Local\Wl3l3Qz\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\gGQ4u\cttune.exeC:\Users\Admin\AppData\Local\gGQ4u\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
940KB
MD58550261899ce82881426464e77b10e36
SHA14a66c3360d180fadb3f35820e733760a52d3d6c5
SHA256d1e80abf0bb5e11f048ae86dc50f20e7e9005ecc258ea3e1b10ca6210d5e8626
SHA512477b65b595afc93f8f36b2e12caef07596de95830766b42bd9aa06a9e77796aa081e77b64542156321827ad8d87d46f47cb264d9d3d8e4b6e620e8e2fe5322c7
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
1.2MB
MD5b5db816968aed84c73ffc637cadaa238
SHA1b81fead3c5329367e69e4feb858ac39f219c1eaf
SHA256eb76043a93352069bfd4536e2c61f2111b3ebfecf8f0c9c383e9683053f002b4
SHA51204dc6473427daea3015dc941671278cf0cb731ac075c12fbb8f1485aeb24fa57092bcb9d8729e6c3c3ea1bad843ba9eb3737c5b9373d464d41b6416cdf53f1bf
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
940KB
MD59cad800ae91b963d24d7b25473b03b6c
SHA1dcdf330d0cf405db39d1e2e882212529cd8c145f
SHA256c93841b6a31864ad9a67a8337f638743632e10847c38d096848bbb6d106aeeb9
SHA51264ccfc10b5da932f4b9d75efa688d19cc8c1d6b48bb6720919a24caba4f91ef23c142bdc53ad97be56609427c938a2bdb9ec401bcc7c87319ed72f628b7b75ff
-
Filesize
90KB
MD5fa924465a33833f41c1a39f6221ba460
SHA1801d505d81e49d2b4ffa316245ca69ff58c523c3
SHA256de2d871afe2c071cf305fc488875563b778e7279e57030ba1a1c9f7e360748da
SHA512eef91316e1a679cc2183d4fe9f8f40b5efa6d06f7d1246fd399292e14952053309b6891059da88134a184d9bd0298a45a1bf4bc9f27140b1a31b9523acbf3757
-
Filesize
1KB
MD50ffb6373a735e0b41dba9cccf126a3ce
SHA12f974ad25b6965c11425eb69ee2fc0a4f16afb78
SHA2563526679c043d7658278f56efdae9ac84f17a8eec101053d0d959c08a53de9012
SHA512e16f07b06807b0dae3e1d5f917525dc8bcbbe9224027e035c83630ea77c6b57bb26843e702515d6290bc0509f9b0356f89122bbaf35f829d2ecf4a9c9cc26311
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
936KB
-
Filesize
28KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
64KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
936KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB