Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 07:25
General
-
Target
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll
-
Size
1.1MB
-
MD5
d21a8a43c577339b6a431daa03dfe6c1
-
SHA1
010199366ab7b43d93df5e690e72c8e62b2efd99
-
SHA256
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d
-
SHA512
d73918a13b8705d3b37eb2adf36eb11c1243517d8aee3b479d2bb00bd4bf96001f6f8b006ab1db6221e2082b02ed14545ece1e7cbbf8d773eb0083caba4e0b4e
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\06W\CloudNotifications.exeC:\Users\Admin\AppData\Local\06W\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\Akx0W\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\Akx0W\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\4vopFDtbk\rdpinput.exeC:\Users\Admin\AppData\Local\4vopFDtbk\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.1MB
MD53f869472dd0f434fa0bca476e1029704
SHA1d99a2bd31d4e8c3af588cbaf9a54e59236164db6
SHA2562112762da82aa598a678bd58217f070d8837465035dbee7d5161477bbfd6460f
SHA512c97c5cdfbac65167e190f3a00cedf6de8d3b9fe57f91da0c6ae24de261abfc6a0b5b4c3598c976caa264bed968f08942fce24d6f83f0de245a03896ca7e44378
-
Filesize
1.1MB
MD55035b757141a0edc1d873f1070b7fa2c
SHA1094fe900fc67703aa5c5a28f415e0b72105e25e3
SHA2562cc51092fee36cae2cb86db90afa3ce19f268bd26a36c7dc5df837de76f8c64f
SHA512fa81bb645feb0b863732a340b1bc7b73b949f8da97d6107d3d134032b59268982b3a5007fe5bf399d87eec1e49cc431f31c543e1da2419a64db92dfce10a8a94
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
1.1MB
MD51570e794732a97ddad995b0f82985627
SHA1e8757f56e6298b6f575ecb3ff97ba588cb46cc1f
SHA256e17e4b3a49d7d8609d32b76e7e0ca1afb9b6f891552f2da76fd29126c3a9f32c
SHA512d95d3e7594134ca6468d552f168cb171923c9562df8116ad12ea2cbd431b9df88da72b1f23f7b4e999a209862f6c98898c88a1e259646e13a2d6609b609ea149
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1KB
MD59417af0163021e6f555051eb772e9cf8
SHA1dd3c0ffd984d28fd0a86ef9a6dd51d1ca955a58f
SHA2563106bbbee116d8b6dc0900668c9d3d690e22282c2a0899337f9e465c6ea358f6
SHA512b31571439ea9b7edeba9f109c489c47e9fcf98cdeca03aade3df3d18e45f9a60771a49e7ac6470f59d3a108a901e285e368215efc968406d8d75479ec5756c85
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB