Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 07:25
General
-
Target
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll
-
Size
1.1MB
-
MD5
d21a8a43c577339b6a431daa03dfe6c1
-
SHA1
010199366ab7b43d93df5e690e72c8e62b2efd99
-
SHA256
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d
-
SHA512
d73918a13b8705d3b37eb2adf36eb11c1243517d8aee3b479d2bb00bd4bf96001f6f8b006ab1db6221e2082b02ed14545ece1e7cbbf8d773eb0083caba4e0b4e
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\N70BU\cttune.exeC:\Users\Admin\AppData\Local\N70BU\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\AnivIfLC\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\AnivIfLC\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\teMj\rrinstaller.exeC:\Users\Admin\AppData\Local\teMj\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD52b369afd320be72e8dd0f45927aeb6c6
SHA1eb3db3b59a10079738157fc611d96b9510abada7
SHA256bd91465ea2b23a043c5fe4576cb28b89793c0c580115bebaf7c28e485ab75075
SHA5128e2aa61b9154a1d50e0801eae0091ba7f2cc8162d91c133a7154818b2d5c605ba57c5b71b6a646a0b27a32486f8112ce4738b5f52d98166a65bc82005643eda4
-
Filesize
1.1MB
MD503161f8be18f4e2e8e6a007d935eab89
SHA152d3238c1b2b855f07f1e923606769cab233d931
SHA256da4b2f8ae07db3df379b95807f86b10667ba103d400384ec4eeb656d75248952
SHA5121798d6065e5a81dbab3333284f89061108e99f82c42dfcf0d2be7c26a74b7bbc74757e0a303c26aa1a23414ecb272a284c57fb7314139615286d84a10348207f
-
Filesize
1.1MB
MD5d14410c9e019960947b9f6049d05aef9
SHA1d137f9e8b8f2c8b073b5309a160433b252a78d32
SHA25602949c0c28c24df8d78b81599cc11bf9ccb9bfbafb3e0ce6a2cc7977a4d89ac8
SHA5129c7e1dc91aed06916d68bc3b29b823ebba96c380ea435b1cc745b9416e9b8ee6947d4073dcd03f5142fa012eab23ff9d96005dd12425c8998eac65f160796e1f
-
Filesize
1KB
MD5e02a7a643b57bdc1b31c6853a5d98fe1
SHA1fd28fae936f286447c802eb81670f870bd9f2be2
SHA25625bf0ee8826928c093a58c7afee7eddcfca05f69ab7d5dc95bd7033c07264bd3
SHA5126947bbc07ce5e657d603e601dfbe47acb153c536aaa3a2ae55d8bebfac75c7d0ba905e2aad60a9dc910e0b1b3e179c35b3e03076d684ee191140f5950d68882f
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
68KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB