Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 20:20
General
-
Target
44b1063452fdb12ba26b5e6c2b2b1f71330b165f1ab8cbb2f199c048f519e8cb.dll
-
Size
940KB
-
MD5
2d9b177ec1f707009b9a808af771d99a
-
SHA1
a390ee7e32d4c73c0eca3b23134cd990684d4a67
-
SHA256
44b1063452fdb12ba26b5e6c2b2b1f71330b165f1ab8cbb2f199c048f519e8cb
-
SHA512
bcc1b7b6a32d43adfb20e81b095d842a1d7c0e197a1f742189cfbdd6fe96f24336f39de968f304ab7955ce66197aaf9ff3a99e12252eadd5adfe6ee6b94849d7
-
SSDEEP
12288:CPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:CtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\44b1063452fdb12ba26b5e6c2b2b1f71330b165f1ab8cbb2f199c048f519e8cb.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\GpQujY\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\GpQujY\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\u18Pc4U\UI0Detect.exeC:\Users\Admin\AppData\Local\u18Pc4U\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\RIm\OptionalFeatures.exeC:\Users\Admin\AppData\Local\RIm\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD5a18f4a39ce0f990c2b1e5ac2090b3196
SHA1c9202a90e94b071ea84c5019179e0902d733afbd
SHA256b27765f996d36718e15657245a664e8adbfe500b598da0ede844c1a7c2aac7c0
SHA51274d945a20c30440267ae4278d6b8dd27908c2dd2dc346d292e2ea7800399fe8d368a9fd34dd76c1ff1131daae209dd2bb0cd922e44f1508bad9541a555af3ebd
-
Filesize
944KB
MD593bc6d626ccf0c0686c7e39e917d9a49
SHA174595079dfc35076c912f8949177fe149e196897
SHA2560d367bebd2a32125ba05dfeab33daf2e8908fdea05123e1c7466bc6e8af3c2f4
SHA51233e65b16a4e55e69fc9bfda63838d703be0593dfe301c964deb2416a6c7c1b47b9c66e0b19b113e19ab50bb105fa5f4017f18b9670d8e9f6b73b3fb6bd30be40
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
944KB
MD5bb7c68e9e8b2bccf6b880f981260f2ca
SHA1e46fdbd3d536cbb57fbf33ce24f2318437aff4c1
SHA256840b971e26d6a95cf93d604bc983933182db19fcf089374a467b395e139507f4
SHA5121e1119493d86ab8ab1bee8b379572da580729d8240cb87672f94b6f3513389c86c4ceb709b07bd132c4d971e940ecf87882920f16f6c56b8de388e4e0c974035
-
Filesize
1KB
MD5493c1476f0916fea3b14518c786c032b
SHA174b758c2e026fa681203ee11456726b6bc607fe0
SHA2560717566cad7fe5b7dcf08cebcb3a90bee40b82fbfab7daa1df6a2bdbf170c96c
SHA512efd34abf141469ce53524e6551303e4893a0a8a374c5018d49dfc7092aacb08800a775d9099d67dcf3514bd5615b00c99002c2c478bf4c0db80f7266f4a39837
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB