Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
11-10-2024 20:27
General
-
Target
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll
-
Size
940KB
-
MD5
e6ffe9204f9d5606d662bf6f355c3863
-
SHA1
1632dfd22740045fad5a1fa5149cde3eb694ae7c
-
SHA256
1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a
-
SHA512
e08cde0affdc24597bd0bbde592fb78afcba4b187d25d3bb0b72949b3a2825c5f8e62d1ef8cf23ce495167517f16516d7448909b538085101c317845b3159ea3
-
SSDEEP
12288:CPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:CtKTrsKSKBTSb6DUXWq8
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1e4aed6e957b55dad4f63b7d5f44cb8ce6a7216b6ad4e51d971d307007ed3d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\IPmpGt\BitLockerWizard.exeC:\Users\Admin\AppData\Local\IPmpGt\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\5XM3oKmYt\DWWIN.EXEC:\Users\Admin\AppData\Local\5XM3oKmYt\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\YRj\BitLockerWizard.exeC:\Users\Admin\AppData\Local\YRj\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
944KB
MD5f8d9275c084b75ed74784522000bbda7
SHA1160a4129f58550344fb256198acfccda694a2a39
SHA2562f22978c487a72567165cdc62c860f7b3f958be2c73f35dfc53f0d7d3e438a96
SHA5125ae96b420c44749234210512779a2c120acfae889e9a1c0b82c72c2622bb050ab012ecb2e079da00af302a344c63c2c15d9c5946dd6f6a57aeb0723f16bef8fa
-
Filesize
98KB
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
Filesize
944KB
MD5aca1a87105e678364188679d4c3b7c5c
SHA10d8fd83c8f737a903c80792d60a848db97332e61
SHA2560d72d706e206914f0116620717f0e9d47238561dc475f3f79395a88fc59c53bd
SHA5126d3f2c27ec373a408c94aa3940a2ed53274a19fc57f2bf2ff038d5b2137f0c3e3ddbb7c62637d7bee359458b588829f52a00d6ff94073bc721383f2eadb3db7b
-
Filesize
944KB
MD58eed68a069ae2274f27b5a3655551871
SHA118ae1c9984e48c869bf7e430a8fa1991ededcfeb
SHA256cc0a1cfb550294b652be27a676cff9d083dae968889d0103177f8c7f19542ef1
SHA512f76252ba39227e015ba2769ec1f1000e702dd782598fae9b5f620cbb624bc7c5dbdb4b2d49ed2d50c867ccd0111be90d8a002a00dfae90ccb7a0dfeff16a3368
-
Filesize
1KB
MD52fef252051be83c43a50f74275d526a6
SHA1f3361ac7e399b3feaa84f51e33dc56ff6d2c0ca0
SHA2561dd53faf5ce58efada16d956453f2a3b2586bfd09c20ed080035ee97d331e786
SHA5123636cd8b998cb9151e0ce9844295d92179c979895f2362e8570803008770b95c50e3537d5b0d2ad769c9b8d87fe805aded7e01a1a992be07029a3b2a25282ad0
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
8KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
940KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
940KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB