Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 07:25
General
-
Target
82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d.dll
-
Size
1.1MB
-
MD5
a7c11f9f36da43856f66e495b91c872e
-
SHA1
6f91468a4e72bc1e07d9016b24c2427c41de5188
-
SHA256
82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d
-
SHA512
84c59a7cda2989deeeba7a229edd23181ce6aec1928580e10ad015e9c9cdce071aef242b956c9a6504435e8c7f026cb6a33a46942a92cd0cd12ff923033e68d3
-
SSDEEP
12288:9kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:9kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\eqfeUdWwl\lpksetup.exeC:\Users\Admin\AppData\Local\eqfeUdWwl\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\HGIpTC\DisplaySwitch.exeC:\Users\Admin\AppData\Local\HGIpTC\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\zWM\wextract.exeC:\Users\Admin\AppData\Local\zWM\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59e475f1a558b43b190fcc6903d1ac80a
SHA1c883a1dff9563d1b5975350f3552e94ed7c1d959
SHA25640068c3a27ab5616b881a8a225d83d46f4781594005a92648b2867560fe15c6c
SHA512892f0dc9f2927fd986a2c5256dd9044cd8c1d52b5c5600a60478581252d1bac5ed457f5dbd28146d9b9e2b2d48efe3be6e53a55bfb983ace4675ed0a9d5304ac
-
Filesize
1.1MB
MD514613bdc7bfa543470939575af73fbbf
SHA1760d8b0dce33dbd7b871e3565282f23c41d965b7
SHA2569385e339a93e7f32fcb2dcc99563e17734eae9a6f5d6b326919e079a8fdb90e8
SHA512720a5686e6f8c637f96d604d93220cb64ed3d00438ffc610aa8b15d1cdf88b36c78a78d02d302437e6907aee1a213d5d2558000e0a51d061d9fff66eea634c25
-
Filesize
1.1MB
MD504777408972fb8f2cb2d6fb8a5367dda
SHA1e6df8551043a187c3259aa9b7d35f04130cbb625
SHA256faba4153d688b6e310981db6e3489736bd0a72120d0e971a877c1b8e27c020e5
SHA5123d4693b53a046b5b4f35b53db0fa0a2113fc5df714654257636427ae283bd28bf93b0e4fc0405b3cd7e6bf78666baad2308c05a8964cd6c7cd5975de2a8e4ffd
-
Filesize
1KB
MD5d4a445c7420385c1f792ccb07678f177
SHA152b8db003191c7900bc2086d6fda51d2a3397be8
SHA2566429299dae3366a9c3b57456fa4a544aaaeecd741bf343fef3293a8de30a0fcf
SHA5128923fd07bb8451dff59a87dc5216eb58c7ad3f05785164622b70bf7b374617fd6a7e66241c6172309bacefd38a283f5305e0f2444cece567b0f256d88c7922db
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB