Analysis
-
max time kernel
150s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 01:09
General
-
Target
1b5c27cfe83c97a8a00dffd74caa9464e5a52bd2ffcac5382db378ef008f49d2.dll
-
Size
1.5MB
-
MD5
39273691ed194c18055810147be4d04f
-
SHA1
09e52e5ef498c927672313f1b9899d0697929bf1
-
SHA256
1b5c27cfe83c97a8a00dffd74caa9464e5a52bd2ffcac5382db378ef008f49d2
-
SHA512
923ab6d6db240e2605ae869ee9c05bc3bf15889c516a5a0fa7483065fb6a539dbcc28eaa1ad44ec7569da980117bca055255abf370fb6e2ba1846f283135859c
-
SSDEEP
12288:lXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:5B/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\1b5c27cfe83c97a8a00dffd74caa9464e5a52bd2ffcac5382db378ef008f49d2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\PcIBjbt\PresentationHost.exeC:\Users\Admin\AppData\Local\PcIBjbt\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\wNQuAqh\perfmon.exeC:\Users\Admin\AppData\Local\wNQuAqh\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\lCTG7V\bdechangepin.exeC:\Users\Admin\AppData\Local\lCTG7V\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
1.5MB
MD55037c738ec8a81e3a8c978db8998558e
SHA1c085a13cf000e5cc4ef9c05b968a590ba6f219e7
SHA256c72fbcf03f2840b9d7235a7a4d65d1c566c107c9ae11d2032d49fa432fc683fd
SHA512ee582f2de2a77766a29f5e320e18c46d21fcbab8f9da14db152f469a65f5b0dc6cac47cb67ebfa65ae8c6f0a983903cdb44bbced74dcfdad9f72fe5a269053b6
-
Filesize
1.8MB
MD5cb7016115bc8367bb49bca34f40e455c
SHA1a3b9c03ba02f625b9abdc64702f8c69bc52ff63e
SHA256a992b947620662900003d9cd97d8824b142a54b581ff5ed662c0f145ab478f47
SHA5124e857b6f26207da698c3c1c0c3746803cbdbd87bddbed0a3f41d40721b43f61b0f2ccd68ecf35e243970ae887929eb58c6c63adb371a92160f62e115f51fb307
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1.5MB
MD5b29e1bb74ed62e688ea0c4422ec86aa9
SHA1143367d7842584de5c5b2b2745448b1da55e4fe6
SHA256821796f4b1c8f7e08324f56ad2bbf99102bf5dc47571df0658fef93bc91ac1c5
SHA512ddc8e9df39f1981261a7d460ebccdd873b1724ce09f479197eb5ef800edf81f180cec716da4fc31e94183b9de0f2f3443df242f175d0d69580a693124701bc77
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
1KB
MD5a96260ce3547ef1396f09a2a0a598428
SHA10d39d7d1b61b25c2a3f1dd74b4eafe21eb8822cf
SHA256df7e9d24a05ce29c3ab50b39812326ac8252444c5ed4dddfd6bf0e0d9bb23647
SHA512cda818f8a68ea71b4d8ff1b1e28d6c4b5cfdccd79faa1b8cc4bcde2291056eff922e9e0ec2c36035dd42626511fc14e77e3aa16bb129cd444c649ee2053e09f5
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB