Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 07:30
General
-
Target
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll
-
Size
1.1MB
-
MD5
d21a8a43c577339b6a431daa03dfe6c1
-
SHA1
010199366ab7b43d93df5e690e72c8e62b2efd99
-
SHA256
8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d
-
SHA512
d73918a13b8705d3b37eb2adf36eb11c1243517d8aee3b479d2bb00bd4bf96001f6f8b006ab1db6221e2082b02ed14545ece1e7cbbf8d773eb0083caba4e0b4e
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8348572110a99fe14e9b92ed34dfd3b5ae924110a02d9baed3061a23955c310d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\iKtYqUa0\Netplwiz.exeC:\Users\Admin\AppData\Local\iKtYqUa0\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\IA5pK4R\PresentationHost.exeC:\Users\Admin\AppData\Local\IA5pK4R\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\NXy\SndVol.exeC:\Users\Admin\AppData\Local\NXy\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
1.1MB
MD5e8f9c13775e240dbeb6a65e4664013ff
SHA15e8a7cb4abc71d2a36fe9762961bd552f6057553
SHA256c72b96210bb3e22c07fceb5c82ff6fde8e5028a63ca713696a2c954590bc095d
SHA5129f6c3456024c955d6473fccdc6027cfd9d2b93ad4063a5b5d6c393fcd8bafff257e75eb5d31177e22e3872aebf1123bae9e798805a55c5e51f6d7a3acef65df7
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.1MB
MD5eb293b47a95a4e9de673bdaff91fda5e
SHA1dd3767a9bdb052a082e12feed1af2c21296e9762
SHA2560dd3983061851d7021f019fc82a38f98ffb584ed00bae9d132dcfd4208db418b
SHA5126f8e8d0736fc8378e8746c6c14a97bfef44eac1b901850b485d4e2fddaad3e7f6e5e97cc63162770c534c7beb48465b7afa8b23f17561ebddc54ba1fd778176f
-
Filesize
1.1MB
MD5c4dee206518adf95273e34ce58c28f04
SHA1c1d974d89c2a1019661bd901b9fcc1a182536b9c
SHA256cc1b1a0817cfb7888f07d993722b3f3d822c3be189fa81fd8a3d818c78e01dd1
SHA51248ef1ff0faa7a076b163a5447f5a8b819f3c51b3dc980aa44cebaf09b7d88d65d95e68808bad9941a90b783db6174de185877491e7f94c602ee4b91b26a51241
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1KB
MD53abc3ec6704e8170956ed4f07cf1fcf3
SHA1f6f1f4185cfa9c0641fe6cd63eb0337ee5217e5a
SHA256155873dd262adc0d6f18d0093c9cfe35e90d43ebb0c945f3f830067f7c2e9de0
SHA512d0d85323a5e9ae73c83605991dcc5f0939d8fee018f7d1ece7647a2d2a97327a593642f2523925c051097c412d4803dcc5da49d3caef8add0c3cf6507d944226
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB