Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 18:13
General
-
Target
e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8.dll
-
Size
940KB
-
MD5
d63ff00d75923760db3db59ad66520ee
-
SHA1
698ef541cd9d32955422d8af16fdbc2437039bd0
-
SHA256
e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8
-
SHA512
347238b6dbe7c5a1b9e4610a5d3b2b9f93ca34a3999c21b1257ccec507bcb1a4d792164f6461fde911147b1cff20e817d575e7c7e10406b9c00fabaf0372b1e2
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\L8ML8ivA0\rdpclip.exeC:\Users\Admin\AppData\Local\L8ML8ivA0\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\CWQ\VaultSysUi.exeC:\Users\Admin\AppData\Local\CWQ\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\Po4HU0\ddodiag.exeC:\Users\Admin\AppData\Local\Po4HU0\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD56a692308039b9b36a255e484d4d295eb
SHA1802262ed8dc250df846753ba5969e3e09834c185
SHA256569f140a2cfd91ed3cebef13d7f1f19e9b8245adfd6c9a3049d0b328419ff523
SHA512d409b041c88da52e79a6f43c45d47ced4726da61d6743b874a74f5aa17856897c943ca71215305c74142bb7cc5640759364f3034473a871bce6dc11e4ec87185
-
Filesize
944KB
MD5e0d89b9d0bdb4b377ce5a74aca02bda3
SHA1311b5bea61835a383988b6844c757afa76ae10c6
SHA256d7db0fa9506d2051f87761032ee03a2aa1c7cea8862b8675092798821ccca5f4
SHA512c92dc67ece62fc8016f434baa0caea715f320e0fa08ed08c0943b56ef787d43076bd2dde4156b02ed1264b1f6db3ad0ef89da01b74bbf52088c986787923fa7b
-
Filesize
944KB
MD56cb1f7001a9932303269b9f1fce48e7c
SHA1858fee5f0a68fa779428593448dbf5c917cec658
SHA2561e9921f8a86037f2c0e134ce58ddbbc204ba5010934ca388c1c93779453b8adc
SHA5125a9cb8f4db057a783f5bddef0e26af1896cee504198cd7baf565946a07cdd68e281e5b215b8eadb5be3b18d7573fb51f6b46d5e5afc027f3fe3425f936463006
-
Filesize
1KB
MD5bdb03cbd3b64db15efce81d7fb87b77c
SHA1035b9374fde76991d166f5ef81c011bb2bd64c1c
SHA256ab92aefd59329e5388bac21d10d3d81fa6b361f1e0d57c67bef8d438c3da8140
SHA512d4217e7630e04a24545480188579826a0cefdec71c63a3cf88b5f924a0e2e7dc4af7bfadb05250dd2bafbda6d70a645c3a65496ebb1c4570cd0af6b3778681da
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB