Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 18:06
General
-
Target
486becacbf7f93c89448318ceacafc3fff79c6caa82e3daf4091857b33326a57.dll
-
Size
940KB
-
MD5
11be54b786128e0cd33b731becbbdf42
-
SHA1
125ab787fdffe99ef10701ffc3b39f651324a9b5
-
SHA256
486becacbf7f93c89448318ceacafc3fff79c6caa82e3daf4091857b33326a57
-
SHA512
10b4229d9a37c2d1b2514c27c4e6525512220f29e6e056d47a1211720829a7edd5a7c996b7c29def21cc6296a96120b907725d8b78bff5686ce809ad9628d920
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\486becacbf7f93c89448318ceacafc3fff79c6caa82e3daf4091857b33326a57.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\QjueNTj\ie4ushowIE.exeC:\Users\Admin\AppData\Local\QjueNTj\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\Wzu3top\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\Wzu3top\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\KBqy\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\KBqy\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD561d6e81d0e2b371f29cd7cfc750bbff5
SHA1a4c4ea5dbadcd03e79acf39c0dd68e7172511fb8
SHA2565c3ef21e122e75fabc95aa9f57fc6f61ab396fb4c798a08f759a1d41d78e51b1
SHA512dc3f2d7c216ba1b33af07caebf3522d875ceeb44962cdb0081c3eaf3ccf38389afec62002d2bbd0a7072a9de48b8a6f53347e5c7d8674aa33936ae1a87ca38da
-
Filesize
944KB
MD5cf70b757efb4e9738236e078f15c620b
SHA1dee2ff6eddc9c83834c91baf4727e0bfe41d2116
SHA2567efd37b81dfccb65634603bcb817a46686805e89c4bdf9791ce2ffcd9c328cd6
SHA5128d5dc5665e654706efb8362f6fa606d06064a51d2d2bb5a4a5a3ed139499d3ce9db645ae4b4330d3cc97f8293cb6d60fc82137b8cbc9f695265c3f8f3d89a3da
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
944KB
MD5e16e041cea43ee5d92799c0e057af303
SHA1d7f174aecc552a97e28cfa6be8dcb106116bbf3e
SHA256f40545f4d2001da84be2a9f3b8889ad921d42f64d619286929e73f2c3fabe319
SHA512e3fd7d6cf283a63026d35ff6e746abdc3ad2c34894b3c01d33878b3c2a5be351ec3cf8e28133de0c9b3e712b40c0db32058b6c4a4d7a9d1a4146aa88f381e258
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1KB
MD5032dc545bc71623c3d2770dffa87b4f0
SHA1f279f03325a5b8d4b9221a259be479c2ae4d1b16
SHA256ceb31e6b2882835114e6390d44cf5930408fdee5a6583800f7d8957d31c05a04
SHA512ea5ba452a8abefbce4d9e87ecc41e8ab93837e70e52b0e4d9a626f0ef13f28826c161766f542712aa54f966798c0d6198f5ec402008184b0ebdc568e990c4aae
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB