Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 07:25
General
-
Target
82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d.dll
-
Size
1.1MB
-
MD5
a7c11f9f36da43856f66e495b91c872e
-
SHA1
6f91468a4e72bc1e07d9016b24c2427c41de5188
-
SHA256
82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d
-
SHA512
84c59a7cda2989deeeba7a229edd23181ce6aec1928580e10ad015e9c9cdce071aef242b956c9a6504435e8c7f026cb6a33a46942a92cd0cd12ff923033e68d3
-
SSDEEP
12288:9kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:9kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82327bfb11e761ca805df5a092ba2ee85eb43c3a7dbd78201a0e807899f6b91d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\skp0zsIfY\systemreset.exeC:\Users\Admin\AppData\Local\skp0zsIfY\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\hnkvFjI\RecoveryDrive.exeC:\Users\Admin\AppData\Local\hnkvFjI\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\H5ICv2X\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\H5ICv2X\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5fb47350dd527857b25d934672452322f
SHA1688f81e00b4e9a838f9e3e974fa3b17b0cfb7e8d
SHA256ed9b0cab84f9439519402177ad550dbe4f7bc40e427c948fa9436f6c50a9bd07
SHA512f3593b0a82f1369de2d50eaa9b657ce9e4fe46386edfc20f5a28bf84df4baaa56a4892da0bb71c575a2049304e2e3bf0482af29020322226607a815080b5323c
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1.1MB
MD59a46b866ea9da43003a5ef538b10ee5c
SHA1fea67880acc0fbe795d9dadb63368d2d5c609826
SHA256a2a2aa194d003c23b754ef93230303070a55fea08d5c3db4115d2784bb7d903b
SHA512342e786b12f9d7094704f82c225d537b557d1872280fd40de4baf129b097ada4603b554047e6904931174cad5e05c10c4842aecaba2845de1a929757615074be
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1.1MB
MD589e94b1ad967ab0152f2dcaa09fd067d
SHA1253cc30fe7c8570c56241559a5cc55b0db155772
SHA2560ab26498233874fb09533f3972a539e76df984e38e10bf81645c618d8fa9a9d2
SHA512e2426239b76649435288bfd7afc8202dca1f06a6aa8f75700c06fe97a8e806082bfc41d2fed5279d44dbbdb19145f06a2fdb5c864e10ded19be5433c9d23fa61
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
1KB
MD51777e25985a8fcd6975bae52fbf3e77e
SHA111b55edaadb7c00c7b9224d1fdb6ce19947e1497
SHA256c5513af0e368693ab8ba787af9ba3f62c234afe84cb2691a0a206f41f4de1d30
SHA512cb54545ffbb6e83ac3ae95b289bad564f00b588af683f2db3dc2ed3e5f17e8bd246da87daee9715ce560eaf78e14ba969b9d04497230bda5e73a0599b150fcc4
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB