Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 01:07
General
-
Target
eb0b173b943bf9399a03852622eadadec68805c0d7176f41e0e621822e071724.dll
-
Size
1.5MB
-
MD5
a2f81479dcf22bbfa3ea600831b3daac
-
SHA1
cc7e7e2a99859fc8d06cc8ff59b0c1f7aea122c8
-
SHA256
eb0b173b943bf9399a03852622eadadec68805c0d7176f41e0e621822e071724
-
SHA512
cad46194da3ea931cc0487a0530b483a526edad634c01f1dbda52345779258dc66ca777821372e5d74516371ca32c192a164ddc6ce336e677f4dc663cef5f9a8
-
SSDEEP
12288:dXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:xB/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\eb0b173b943bf9399a03852622eadadec68805c0d7176f41e0e621822e071724.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\Ap99uDS\rdpshell.exeC:\Users\Admin\AppData\Local\Ap99uDS\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\ptuRfitC\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\ptuRfitC\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\fWuw\wusa.exeC:\Users\Admin\AppData\Local\fWuw\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD5315fa9fea93a619e0d317d70948b977e
SHA15d3566b586f0b813669700baf89dc736f8bbeebf
SHA2563a9322f07cc089f6dc567531c4ef74bfb83e854e450def09a2cb2e3fe4b4bac7
SHA512f03f6103a9b77846a4f1b5249e947e50d9f4e8a3f3bcc959f31d204ee8f306d4d642f71a535bb8f26a069c9647a085502cffab0eb0bc271d8e14228cd3b8670a
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
1.5MB
MD56090b71fd8c5be213c91f86cc9c32e28
SHA1ece64f4a0a59f96b393511bbb1be723a04ee7610
SHA2568119da6920ad055c33d79a2d62d13755f8c2c583741693ad1caca78482fcab2b
SHA512ecf4343665680198d4c715970b1f3ede8c13376981ef161e04ea56df6daf4f1ad85b3aa4c2e7b8bdb1ce10e53a6b35ea12b4ba9d7c6c621e8fd0fbeb93b07f59
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1.8MB
MD5d0389dce5d9dcfec054fdbc2319521c7
SHA14961d7332a1fcd9791b18d24ad02078d36b12fcf
SHA2561ee086a0c78dcfcfd0d0f0131d10e8941e1f44d9383d2593da29cd13645f134c
SHA51251fe8fc628a82acd547675b2352f340556bab2f10b6417d3f8b98243dbff2c9c1162d2e1baee2a19cba804e2a96cd03069a14819fbc4581b904b136b14700f40
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1KB
MD57288c5ba533ca14b2d13a3c9d04d04f2
SHA14d079a31ec74c81de3515bc736f43c4091bf9a27
SHA256d9e9e2db94c9a04f9d13cb1137daac4f98e8f85ca175c6a2e1a83c4c84d59e06
SHA512b713b7998739fde426f4fddb74e8657b3f63b801464b23f9e86ec0e565fadab7c27e98b76abac73d34f5638f0aa95c911958a0d1a23e3b0bb7dd8e70db9ea9c6
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB