Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 01:10
General
-
Target
e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459.dll
-
Size
1.5MB
-
MD5
18fe877565482627cb5fe6fe8b5f5440
-
SHA1
8e7e8926e6e88075fdf115b72bf63e47ac93c258
-
SHA256
e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459
-
SHA512
11688819210d0eaa084f11d7f393d922cac9b86f803259ebd8d77db4ddaaa5e37b5deeb8324f2ac995241a17b1aaab51d4b287ae6f79885f71a6a49c5ec79e1d
-
SSDEEP
12288:+XBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJLnq:8B/Qn0rbD8UZUDtgIiemI51Mwtewkm7
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e1d0c9ec091309e43c83ca07653cf608a2b60ea3f195f6692a13f1f70faf4459.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\IPJ\dccw.exeC:\Users\Admin\AppData\Local\IPJ\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\r2h\RdpSa.exeC:\Users\Admin\AppData\Local\r2h\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\Xfel\AtBroker.exeC:\Users\Admin\AppData\Local\Xfel\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
1.5MB
MD5e84c178e9104d62f5b1b92a7659f1145
SHA1cb5a0c3ff09d8452d718e4a1f745ccdd4c33c46c
SHA25660b8405827fca356124afd6c74a5e8c7bbfe201bc3939d1b8e326e97e41ee555
SHA51290c8d2f4d31b94aadc9e3d70aee89b83c4af482a2cce08eb8123daebceb98324012e2d2ecd6a28cde90a762065a0e75951cba60093425127495ca042e50b2232
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
1.5MB
MD54650e5e3953485ed692a2b4287f8b3b9
SHA18f4578592d21927fadbf52387e12dfcd688508a7
SHA2565c919c5ec412d2bf59bb59598c8098cf217bac7f6331fc406f5fffc8ba52d3e2
SHA5125a78cd7a3461d6d69cf1d27c295434a9a1a668d8f6a63342bf4a0835f7a2ac4eb7ca4926dd64d89b0be5ccf64add63e409c9267832d1206830527566e402b9eb
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
1.5MB
MD5ac8c6ca9e2991bfdd61778e7ec078ff3
SHA197105a7c299f51ac8bb044fa72bc74945fac6f0f
SHA256098f661a26579880adc576af41ad629ab6ce8fd8dcfc2ced18b3a8aec8e8bf54
SHA512395c469e01fa933e98b05399c407a32cdf09d4a58aaf9a5800083a40f5948ba09574e3d18b5b65cbe0b4eede57f593ad8c90a8c4757c02a823552068c1a789e8
-
Filesize
1KB
MD54238838ce4bb695b236b39b60f1149e0
SHA1968e9addae8c368d25e8cdbed5e9fc9ad9c26fa4
SHA256bc028467f6c77ae925996fd63c0fe6047cdcd5ba0c6398521390bb99f610b668
SHA512ce13331fc7dbf6ff01d785d3baf27fdf68f3f3a46389f279f6a935797fb620ce2730a0486e1afa7dc093606af2c12d52c94f1f428ff70c2a4e40330a968e9122
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
64KB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB