Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-10-2024 20:21
General
-
Target
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll
-
Size
940KB
-
MD5
e6ffe9204f9d5606d662bf6f355c3863
-
SHA1
1632dfd22740045fad5a1fa5149cde3eb694ae7c
-
SHA256
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a
-
SHA512
e08cde0affdc24597bd0bbde592fb78afcba4b187d25d3bb0b72949b3a2825c5f8e62d1ef8cf23ce495167517f16516d7448909b538085101c317845b3159ea3
-
SSDEEP
12288:CPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:CtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\Kwvkl\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\Kwvkl\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\FDaBzoE\CloudNotifications.exeC:\Users\Admin\AppData\Local\FDaBzoE\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\G3Aw\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\G3Aw\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
944KB
MD5afbe5299ab8b5be8cde2226dce48d801
SHA15348707f717c5c7f28fcb3faab75b77ecab8ab58
SHA2563f0f06d1f0a41183103d735c220c00acc983120a23ad95fc9adaffdabf968d71
SHA512a3999c7d826f3da94148d07c61429f2f61f3fa32c3d227be5590cd89b1b9fd13eeb68c51293c0b5f0fa6ad8e88c57db9178fb39b0acad8df65d2def1c5a2831d
-
Filesize
1.2MB
MD531eb77a645f86941c19237a3fc82761d
SHA1d69c36f789ed0019cb22dbdc9613b948449ee9c8
SHA256a51bfe5379d1473f3fae51d44191d7e2e209ea6309bb27fcc4ec642e2c6fb9c8
SHA51253d3bf03646511518ced02f2eec5f203a4bd2429ca5239d80b1d33f378d3be354ae4f6310dd9cfbb640c4d78bbfe11b22ad80ec6d2020a7766119505197f08e0
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1.2MB
MD55c6d78f760567f2286b37cf859fde093
SHA1e7a4d21bc2904c6bbb7dab0f405161be81589421
SHA2569f1e4673f24484ef5c3bce5f93e89a1cdbd1de67e44197d82ad813c531feaa21
SHA5120276d0619a2d22f3c0879c32ec33f8def384e77261fbc694aea4c84d41479ce097b0f65e2231ba1421c40c8c838705e008d43ed68b62ad10d1f6d1b26c836f02
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1KB
MD59a24274b7fb9f87ec46443d99c4fb1ba
SHA19e3748c6bea520bb20d80435c4ee8ee37ee2e0a0
SHA256e69ea2ae588d0aa17b9911423fc6f109981c3870f3e282d62e7d07583923a09f
SHA5126e96aed0a4fd5b301b212535fc9d592de1c1a6f92606a45bdaf8149b8f74fab4228eb17dd50fde969c7a874fde2638c0075e296e5989a9d3383ecc77570fcea5
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
64KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB