Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 02:07
General
-
Target
e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll
-
Size
1.3MB
-
MD5
c1149d0d1cd46a9b3eb35371b41c4a63
-
SHA1
9001ee8245fd45cfdf537afc41cdf6338fe66928
-
SHA256
e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8
-
SHA512
448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba
-
SSDEEP
12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\kfmx0HzUc\RecoveryDrive.exeC:\Users\Admin\AppData\Local\kfmx0HzUc\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\gNJDBaYYf\rdpclip.exeC:\Users\Admin\AppData\Local\gNJDBaYYf\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\90O8QWarG\ie4uinit.exeC:\Users\Admin\AppData\Local\90O8QWarG\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD51bfd74902fee3728fd986e43075ec7a2
SHA15df744990a6a366851ba304f6319a70aeb92ffe7
SHA256564baa64010279c02ff7548f34661480a7f5266c96567a62d63073f15c7f6700
SHA512c07d025e58b13dede73456a92faceab75755dda242a0671edc93c17decf23fa27707a9daf46b9a6691b646121c399cfb73a3e58470285c893b758971528bffa6
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.3MB
MD5f1f3095b7fbbe102f6093126bab27856
SHA1b6c6cbc7496e56973693676de31bccc64e50ff0d
SHA256c23aff6cc69c0ba698567c08d8d63cb3201eefddc930815704a855da552b3fea
SHA512c294274f2c197e17cae8b5f3dc5f850add2fab5afac7d695e552cc380b39fc19eec6b42dc41beba66f5d3bff9f36647084b47adff06f639ef66bfa889a83a8ab
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1.3MB
MD5e8238f3c86abc592c8d1db2d1e58d699
SHA13becce3915a056bd1fd1134e516d8213e8cf48f6
SHA2564b6b3ccb8c66e509727751bb15bbd2a112e070db509b3274b90c4e37fb1688ad
SHA51248d5f3a02d7d5ece1085c7708755e8d265b14339dac7bc434fbb6c47deda5a818eb8beb758bc30d22e27aa45d5ec24befe730d3168b6a4522bf2df83351c3723
-
Filesize
1KB
MD534143349e03d58732437382b16effb8e
SHA14307e6d396ea3513571af81b6559d8d886dffd29
SHA2564e7658ed573afcacb9de2ca98f063533eba927d1904a38cc0f81da948c083033
SHA512354289179e4a95e745c36311824a5c7c9e270aa7095090b94742f3c47268c112983bc05bffbd234ed6687e3d6126f7af76f939b257a3a91af37dcac04a364582
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB