Analysis
-
max time kernel
149s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 18:06
General
-
Target
06618db79b292fe5270cdf536e70181a66533021d5fba89cf6cee8151e28830a.dll
-
Size
940KB
-
MD5
4c744bdf154706d67cce0294ea1c301c
-
SHA1
177a8dd5df4aba873b8c29d2d2f52d7188204de0
-
SHA256
06618db79b292fe5270cdf536e70181a66533021d5fba89cf6cee8151e28830a
-
SHA512
76481e9906d7c8225a77e6d87622c9f79fe5bd3f44f22a04487747a15f2966f0cab259a94f7ed9cd08f05203bccff6d4001e143a6420910a8c96c879bb30e61a
-
SSDEEP
12288:wPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:wtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\06618db79b292fe5270cdf536e70181a66533021d5fba89cf6cee8151e28830a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\tx5zgO8\msdt.exeC:\Users\Admin\AppData\Local\tx5zgO8\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\nByD\sethc.exeC:\Users\Admin\AppData\Local\nByD\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\vzbHfYJ\tabcal.exeC:\Users\Admin\AppData\Local\vzbHfYJ\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD55ed06ab9403fb7063937a0488a99e314
SHA1c86e7d0e8f98f710c6d50dba3ce3f8b85ca38b16
SHA2568ae3d86a3d8914953215722c45bbc4af52d591e3a665a73ef9398a1a2fece9f6
SHA5127ed1fee2d2776a1d09851bb3099fa1e0807a103051f7d1a421e975bf3ed3cbf5125f1007d7d719f4c6657354e6073f421f8a1dc66c97eb5c063b860970278ca0
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
948KB
MD5eca60aab891cc75f2912406f1246fd58
SHA130ad25ec0420033d717dc805e5a7cae0eede671c
SHA256ce7c6ffc66f5be90ef01f6f7f5923b3e9d18f58830a09c9bddac4d55b1301654
SHA51225f8aa22240d81ed7050d855ecdbff6944e302a9d46f9c37b74098c41d34637b7f4dbbf8bce35c95d6548f11b4514c7ee39083a61aff282b9edcd59116db372c
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
944KB
MD5e988db23aae77bd66932b1e01a6fe051
SHA11e6df1094e23c111782809cd9719aba676d0b2df
SHA2563fd5f3b0d9325b9eefcd29640a4221bc0fa7591f35baad37ee0ff753482218bb
SHA512b78d706f5721a2fc7d94ddc4753d9ca44fcd252ac9afd109d449e8b037003c2fb333bf71fb25b6015109382cec0b0a8f813bd5881b84d228f1eeab7226f8624f
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1KB
MD53b460f4ce18cb68680400eaf105fa796
SHA1825d20c4147e3b00a01019d91a0cfc6338192aef
SHA256d83b1eb22a10c8069ff49474aabeca16ed6f8ba48d56eb9ae7a4bed6186000bb
SHA512e1fac4cf3a4ea74d2edda4df9b5576a527d1447d80fe2ee7a333a09f80461418e4ed00a37492b3c1b30b8094407fc4460df06c92490f29813e16064fc66e823e
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB