Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 07:30
General
-
Target
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll
-
Size
1.1MB
-
MD5
d21a8a43c577339b6a431daa03dfe6c1
-
SHA1
010199366ab7b43d93df5e690e72c8e62b2efd99
-
SHA256
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d
-
SHA512
d73918a13b8705d3b37eb2adf36eb11c1243517d8aee3b479d2bb00bd4bf96001f6f8b006ab1db6221e2082b02ed14545ece1e7cbbf8d773eb0083caba4e0b4e
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe1⤵
-
C:\Users\Admin\AppData\Local\5IxnE\AdapterTroubleshooter.exeC:\Users\Admin\AppData\Local\5IxnE\AdapterTroubleshooter.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\ZdmXTu0V\xpsrchvw.exeC:\Users\Admin\AppData\Local\ZdmXTu0V\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\4Soh6GGK\wusa.exeC:\Users\Admin\AppData\Local\4Soh6GGK\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD53648e53d055f6cac4bff1f9bf520358d
SHA1d87122ab8d4b42a48159c53592537eb22cfba044
SHA25699ae7b01478681403f57238c9e6d0d6cc81dc7f19223823dcf7c78d0e3216c91
SHA512645b6bfee581b14a69749d47831ae74e69b39da6200f15729f1e79590e94d5c92e65bc686d6bebed73419299d1a7f0d444eb02c70f5885954b636107d8c003ec
-
Filesize
1.1MB
MD54cedd2ae5dd95b245d5c7fcae30080c2
SHA108c05d00fcdcde24b61c7fb7931260e8779ba193
SHA256246397541e0714ee56e6f0564122da6e074ecc7481e09cb368bd6410fd16d71e
SHA51238a1caac13eb8caf98705a25409414ee02a467cee4be9ba6a37595bbcc8e1b8c0654afcdc758648a71f36159716870f3278567200db9f995ee72d3a01fcfd5f3
-
Filesize
1KB
MD5233220e4a8a3acbf18a701102491e805
SHA1e2642f4103a363b4d0193e21327577688d250834
SHA256e125b77a690b53062fe59f7099bdfb9c1454d380f2ed36d4691ee57778c72c3f
SHA512c60569a8c9ce48426986bfc36fd02fe88453349698e55b6c71810eaa82ee63f6e6c01012d92e5adaf1569caa5d6ce8da4312b16a8bbd5b863b1e3b28fd0f2685
-
Filesize
300KB
MD5c15b3d813f4382ade98f1892350f21c7
SHA1a45c5abc6751bc8b9041e5e07923fa4fc1b4542b
SHA2568f067da98eb3ea9f1db2f0063ff54e07d992fbf051779b467e222639be4127e3
SHA5126d028fe81fe45d0ef291741513ecf939e412912647347d4d5bad89571f33e1084dc0fd26eb7313c7191f938c3f50243f453e2690e2475fc3f5539a20c2ff2f3c
-
Filesize
39KB
MD5d4170c9ff5b2f85b0ce0246033d26919
SHA1a76118e8775e16237cf00f2fb79718be0dc84db1
SHA256d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da
SHA5129c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608
-
Filesize
1.1MB
MD51e5ede0b941252388dc2c7243a68fba2
SHA1221281ad6718d3d168229b55264b771a780102f2
SHA25625722eaced3f48fe512929fb65e419ba4d4ea8f034a3b6ee3eb996b8e91f73ed
SHA512a9604e40e7dc9f2d3431e1d19b12da541fc822c1608d8e5d3f6ff7746da08aea8b64bb5e73f46ceecac2e2a121ec36cddda5e0d7d4df34fa35aa75f5eac30825
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB