Analysis
-
max time kernel
149s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 01:07
General
-
Target
fb1a305589018230311a426fea737ae107770eddc6441c497d02baac206d7110.dll
-
Size
1.5MB
-
MD5
1e9ff1b997f023586284933ba6f950ab
-
SHA1
c90cc77bfb1453f9840d5687667a494e6fdea326
-
SHA256
fb1a305589018230311a426fea737ae107770eddc6441c497d02baac206d7110
-
SHA512
e75cf5e46b652125845a1efe8ab1086c08263c36f18fc103da01e0553b73a7c9601de888c09b940ae61cba1487202039b8e0b7b25e32e4c9286f50b9ef443fb2
-
SSDEEP
12288:1XBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:pB/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fb1a305589018230311a426fea737ae107770eddc6441c497d02baac206d7110.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\TEFMK\wlrmdr.exeC:\Users\Admin\AppData\Local\TEFMK\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\eQmp\sdclt.exeC:\Users\Admin\AppData\Local\eQmp\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\bU2hX\DisplaySwitch.exeC:\Users\Admin\AppData\Local\bU2hX\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5529440e031562a538390c9fb1d8ebeca
SHA183094164ce5e588996aa49de6a4d3e5e97c92f45
SHA25620e9a10741ea715918a9dc5bc0ad4aa5ad0f2f29bf46e34db9c73ae1099197b6
SHA5128dc6f625fae9b75c06013fc83db705af5358de289763b11c352d1e4fbc9977380237e2297a16663ccbba49c05c4d637459802d8e52f7d874c47677ab5b456f6a
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1.5MB
MD504af209cf02c346bb6f4b0c8c70d0641
SHA14e8cdc51b8ff59c7fe643561202dcd7ea5fce39c
SHA25662fefacb0f3d72a04566d10c00fdbf9c6920b6172d05c0f3792f1f9ed6d07830
SHA51248a45f794df57d7dab2debaaa52f1088872993b882ac9098692bf91a76fdf4ef6c978ce4c7a2f0fb8848965a57b62bc4496007ba032b311a5f99b65079aaed6d
-
Filesize
1.5MB
MD576ccfda34510ed3650024e900509a76c
SHA149099858903ddcbe37033480e4bd16a79dea13f4
SHA256d2f733c968e8faf626740c14c0b7f1fe39a248523f0e72f208a4b2ef008b9d2f
SHA512b916cf8be08e4e62a4fb3c7fed2ee55e627d92bd0f683e0bb06c598f8ff21228618f4c59a0e12fb71685563aeb213255d5a6bb552353349534d48b8614ca9113
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1KB
MD56ea864378a79b455c5940a983727f589
SHA1c480f47f745765ecaf23cf1418ba035d07888543
SHA2564a2bb53f5b1d5a9bc8068d80ae35a0322c51b7e63f5656c189c34a3116b699e8
SHA512b21c795d0f39b22e7625f947b8b0ed1f789e35136063e5449ba430f384e11cb2718eaa97455283684aa6a5e2f36d45a5068c627abfad7ecb3c47cd870af5b8fb
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB