Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 02:10
General
-
Target
e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll
-
Size
1.3MB
-
MD5
c1149d0d1cd46a9b3eb35371b41c4a63
-
SHA1
9001ee8245fd45cfdf537afc41cdf6338fe66928
-
SHA256
e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8
-
SHA512
448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba
-
SSDEEP
12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\bEW\RecoveryDrive.exeC:\Users\Admin\AppData\Local\bEW\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\CPzqn\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\CPzqn\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\HlqHkvU\rdpinit.exeC:\Users\Admin\AppData\Local\HlqHkvU\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5cc02a836a4eb955eb4d0c58035a6f581
SHA13dc41de41c03464f2d5b67e0bc45fbb063644e5f
SHA256c112f34df0e56f253428e8ccb4d64555bc566b496f88c2029d89db329c38fc1a
SHA5129f98c002efd2870a467d5d6d52feef9cd772c85d4c5b4f24dc7bab83b75361021e0c7d0705e8f68b5e05fad753bfeeee3eec208e1fd95a9f354664b1337679bc
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
1.3MB
MD5124ef5f7f0a0b526eda0dc97afe7caca
SHA1851792312df4a99558c26e463ee02107c7d4c227
SHA256a98c4f34bb5aeac5c68913ff9b404f86d800fb3ea4966c6e7fb717e062038579
SHA5128b19856d89a5ef4b51f2b5e0564d87b060ca7c4384f22c621a66de880d4696910e125f4825af3501c5c4721a4768616ea87213c3c2a4d6772eab38c71d9a0a35
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1.3MB
MD52b2952f23a27dc3d7083f8635e3cc45b
SHA15cd1ea97e7deb1638cd95e693393c4b478aa9828
SHA2569e3d15a1c02198b28f35eefc318d747130d24316abfcd86b2a967bf088e85191
SHA51268a5451540b6a328f6bd3bf92ed8b2d4a4c31aee9e3ff06fc233db904d702864edff8bff30e7d58279b757d19da6441c3454db418a0417b0d23d67aa04d78ab3
-
Filesize
1KB
MD5c7bba5cc4a3974d4b872c22540b00958
SHA158811bdc1625679fef9fea80cd79431bd715d14c
SHA2568c53dbc8dfab080cfdb49504b02f0b5fcafe1750236d6434f2c81eed7d3bcaff
SHA512913bdde740d84adf6c514244e10c5eae97209ce28cffb8dcb2cac8f02070465044563ea1a82925f887cfed8671b1fca38d56198ed72ff00c6b680e37873d43fa
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB