Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
12-10-2024 01:10
General
-
Target
e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459.dll
-
Size
1.5MB
-
MD5
18fe877565482627cb5fe6fe8b5f5440
-
SHA1
8e7e8926e6e88075fdf115b72bf63e47ac93c258
-
SHA256
e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459
-
SHA512
11688819210d0eaa084f11d7f393d922cac9b86f803259ebd8d77db4ddaaa5e37b5deeb8324f2ac995241a17b1aaab51d4b287ae6f79885f71a6a49c5ec79e1d
-
SSDEEP
12288:+XBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJLnq:8B/Qn0rbD8UZUDtgIiemI51Mwtewkm7
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\QgnI\raserver.exeC:\Users\Admin\AppData\Local\QgnI\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\IJWK3OqS\rekeywiz.exeC:\Users\Admin\AppData\Local\IJWK3OqS\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\tOdhY\VaultSysUi.exeC:\Users\Admin\AppData\Local\tOdhY\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD56b2a986924e2f941b5f16a8951d82be8
SHA1ee8baf0b487c3dbb55d81413ed00da16d29e9001
SHA256b66334d786b469b7b8fd36b364d07fe50f1b63d6e3930233ac3f60fc06823e62
SHA512b1cad64e6566f900ff37c59602fb5bc078b79b62674803120a7d9c8fb3051299c1c825f6a8c071f45e887d74ac9f5bd4b99a053730afa4d9e40605cd604c6bd7
-
Filesize
1.5MB
MD53759b16027a38d16ff6b08d2675f4a7c
SHA1d78695964eef7b977b19277e0eee631c81dc2168
SHA2568fcbc0967c70baab3e064b6c64e108af25a846960e4752e3c5f309787fc60971
SHA512f3eb6316db42c3d7bacaa677c196b0e311ebca25ad3a5de375ed983dc5137b74415e6d1cd992326f0696e96e43ba39035a5d9e9ae6bb50867b26e2acbfbe8c8a
-
Filesize
1.5MB
MD5a5a3bd58bdb5d534e323f5af91f5090d
SHA121ce56d9da32b4c88b5123fefe012dc407156354
SHA2569a370345e817905c35737a8ba3d37c4b9e3260695f22cce0ce30be56ca128af4
SHA5123b36cacfcfae9fe9102d4bcb3d889390a4029b813762ab3aea71641586563b0c0126b9155afa283102644b93cb34f303eb8562072a8da9d70a7da7fa90d04db9
-
Filesize
1KB
MD5beb98fc0e3ca316087f5cffe60906a58
SHA14c8b4e9bd212f81d364e1c76aa7db2b3de8933f4
SHA256a50e6fb684b8d0925cdcf638b51fd3c2c9af1fb36b995348204139b032d29c77
SHA512659d06ebb9475dbbd23ca41a4e62170a0d11f4fbd1bea4e02a0ac531e8f31aec9e8be3a306a8f0daf2d76d0d4b0a2e1d890638f98698e64efa7f6886c4db9c06
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB