Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 07:25
General
-
Target
92b4e93c7a975815e2adc790967b59c283aec15614dd14ef1cb1f3b9de5575d1.dll
-
Size
1.1MB
-
MD5
15815247242b43059aebf26e60e3256b
-
SHA1
35b9b6fc8eac16bf80665da6a3fbd4aca140c494
-
SHA256
92b4e93c7a975815e2adc790967b59c283aec15614dd14ef1cb1f3b9de5575d1
-
SHA512
d937b72eed31749bada0d69dbefcd27c528d05254369f174ce928f31b82dfb6fa5d54905d3e72d0b8825346423cba71d631de1903cbd7ca9f83e12c822fa2ed7
-
SSDEEP
12288:5kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64CR:5kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\92b4e93c7a975815e2adc790967b59c283aec15614dd14ef1cb1f3b9de5575d1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\CQt\mspaint.exeC:\Users\Admin\AppData\Local\CQt\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EaseOfAccessDialog.exeC:\Windows\system32\EaseOfAccessDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\3iZ\EaseOfAccessDialog.exeC:\Users\Admin\AppData\Local\3iZ\EaseOfAccessDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\wZrb\wlrmdr.exeC:\Users\Admin\AppData\Local\wZrb\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
123KB
MD5e75ee992c1041341f709a517c8723c87
SHA1471021260055eac0021f0abffa2d0ba77a2f380e
SHA2560b1731562413eaa972b373cd7388c644a3059940ce67eb89668e4073f3e068dc
SHA51248c3a8531df6bcc5077367cdf32af104c94cf7701118a85e8beabba2e9c4f511ae14e47b6d1b57d11a2bc1e8b4f6d5bacae27a8d16fcd09a8f9e0018f5a6370a
-
Filesize
1.1MB
MD501bdc26c3b7946ddfa7080d00798ac4e
SHA12f0dcb7498624e10501bffb5175183ed2b0218f2
SHA2567377bb017d135a20476889fe1c99dfd74b4a65e392e70114e280da38ff60d146
SHA512992ae9d9ab2c87daaa50643fea1bb6030b5a84826056e3996ce0a7036387b41a92dcea9f212276afb5d2ca5ad319e98be5b4708890426b05192156e988fc4613
-
Filesize
1.1MB
MD557381f722364a79e283b8e6a0efa1f2e
SHA15b9ec8fe0f7bb40fc26d2db04aa2fede8db16ad9
SHA2562470ed3d1cb6245f93eed0f93748a995f3e0bc0f3268947c6c01d59a48a44cd9
SHA51259030a038b12dab620e3a43a4834a3f31cf62e8071064493d0fa765e1d058fa84a8bd5578ac6e7c477b81c6e1ec9eedcc5a4ed922f17b9b98c9b381a43657a3a
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
1.4MB
MD5f7b5c0020239acc875ce537d69656899
SHA14924f3ba64b69657b329e7c373acaed0b8b00c91
SHA256805ca617026fd1fa2d8a67219c898810d0f0cdf42b69118c6418e6c9e82f9c47
SHA5127aa0ca428c7c8eab9ed844f6ff0858e4efd7e5ed1f46c36fb964fa280a8a4af48617227376ce8076e388ff4d8a63b07073d79b2ed334a227d47e418ad9990e10
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD52a9f9293ab74f0dbba7b432e77897a4c
SHA12ea35edacc1c3eaac243e1019d6576f20a45d3ff
SHA25657a3dee2831710a49a61b0cae781bf76cb338fc550e2f665877fcd43d7089a1d
SHA512444d024d41f757615974b5e739fcdf63cc52a9122bcc44ac13931e7daa2d1a637b942721aaea5544af2486369243c9d90b2cd831c0834287d5ac2a64930a140b
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB