Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 20:21
General
-
Target
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll
-
Size
940KB
-
MD5
e6ffe9204f9d5606d662bf6f355c3863
-
SHA1
1632dfd22740045fad5a1fa5149cde3eb694ae7c
-
SHA256
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a
-
SHA512
e08cde0affdc24597bd0bbde592fb78afcba4b187d25d3bb0b72949b3a2825c5f8e62d1ef8cf23ce495167517f16516d7448909b538085101c317845b3159ea3
-
SSDEEP
12288:CPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:CtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\qAWt0\Dxpserver.exeC:\Users\Admin\AppData\Local\qAWt0\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\hLcr\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\hLcr\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\8dqIYNw6\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\8dqIYNw6\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
944KB
MD58af31d8f492a2650bfd90b1d073a020c
SHA12ce178ff5f2df5b4ee86119119932973ff9a58ba
SHA2566d60ed3a63ffcf0f84a6fb63066ed1d046ff1c9ac30a16b0eff14cc8ac875afc
SHA51294b662c4342484641308bc291da91afaba8312b813633f02e39357fdee7f5ac7953e7884a355c7b16fe34418ad288f83ba3ebc6fc8077cf739966551ecdf6ca6
-
Filesize
944KB
MD574520a692e09474a8d79a9a7431fc7e5
SHA1821ab346b9d79119d3fa09b5488add4b07cc841d
SHA256b923927e5a5d1b26935343eacd1dc90f950a57c3e3cc45da23c917cdf09ed2a4
SHA5121667d1dc0ef5cd00b7a61a65a2e39469afb1e19a121a847ca53c287279c440c9ae223e871a76ee0ca3e442e605510927a72d0c34498cf2a891dc93a443c699ee
-
Filesize
944KB
MD5540a40bd6a481859044f711a376d7cf5
SHA1a1d2a40d9e0d8f67057d1e7ab604296ea74372e1
SHA25692c45224f1375aa4a7bd797a6e8ef0cb7fecd2356b733a523a311bc1e6f7ca34
SHA512068cb8fa305cd8bea1109a8b742b8fee5c7621494e950063610e8c18dd800e73d1a7e5a2c18880239eb641098730b0d03c808110631533c597bcf7c39b85cb27
-
Filesize
1KB
MD53712c821e1335abef9355977fcf65300
SHA10633162bc5318586a6a0d38e06260fabb30516bc
SHA256e4ea1a8539aa83fc00bbffde3a38137f4cff700496933775ccb643e9777ec8aa
SHA5122059bb246333b79ad2b10903e722d53541069209261cece5712a9a798278f401597dc10bbea975694fa55ae3caf3b012131dcd0a4a859124c149d6c9a8ac1a05
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
944KB