Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 18:13
General
-
Target
e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8.dll
-
Size
940KB
-
MD5
d63ff00d75923760db3db59ad66520ee
-
SHA1
698ef541cd9d32955422d8af16fdbc2437039bd0
-
SHA256
e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8
-
SHA512
347238b6dbe7c5a1b9e4610a5d3b2b9f93ca34a3999c21b1257ccec507bcb1a4d792164f6461fde911147b1cff20e817d575e7c7e10406b9c00fabaf0372b1e2
-
SSDEEP
12288:gPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:gtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e9e528ce64fe548d5315d36d4ae765585f2c28f58104c3d579377e79862cd6b8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\KXGOg\upfc.exeC:\Users\Admin\AppData\Local\KXGOg\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\5rzm2Tk\dialer.exeC:\Users\Admin\AppData\Local\5rzm2Tk\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\m93fq\GamePanel.exeC:\Users\Admin\AppData\Local\m93fq\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD582e82aa3b19c4dfd21256286835dd303
SHA169508e62155e7490a4cf368062de0198fb727a14
SHA2563d6242cee653ddfe4523f93ec4434c16c4fb065edeb2642f2e363df95315c05d
SHA512153858897f44f0b0bee18ba651de7f448c3429e380ac27c2c0795014affa579a92ba92828d9be729c6c7fe746c3a5b8d09887d16354937f2a7b76654d10c9f1c
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
944KB
MD5706a2b5d5f6efd9035817d02f53489b2
SHA16836d68b25e60e69bb151154309a91aa16d92de5
SHA2565cf30e7a7dabc7ab413041cfb116ca2136b4ca00dccb941a69e8d499a41fe3e5
SHA5122c220dfb3fc339fb13008e2a6dcf36478e2a9cbc5888f093e8afcf6fc6cca6f187d850a4c6029c4ce171eacd5abce13a51b6191cd6a74e773c3d2167e4a144b7
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
944KB
MD5e7ac7f769cfea64cfd57e329fab1168b
SHA1cc2487b531f7d9bc1ee0785660dd119e4f4b2056
SHA256a8308a2c98d2d354f2772b58965f22fb735822b407386e365bedcb410a21ba8d
SHA512234813ae6d9e15423c125f79da18f497efd92f2cf384255fc8533779b8bfc4a94c57cfe93305c53647397ff46d4030d5903fb58844fd16d2a2fe1ba8fab6979f
-
Filesize
1KB
MD5d6a92c0045beb85178d8e9f8cdf44e11
SHA153fa80f79915b30d1c25dccbf09c587283458684
SHA256bfd90a40880344fb9cd7658638a52afe32a43569e117262eb8ee9e6429ddb6dd
SHA51211226ca07f104f8f9d2e1b1bd674f8c2620430221dd17d4bf6f8c6fa9da5a010d5803606bf33d5a247d75df1c8f412f698d9e0463d558cc98a21655c56fe5be8
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB