Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 11:10
General
-
Target
7630a12359a46806fd7136d9900fba44a2221ce67ad7a31007c3857238b6d3cc.dll
-
Size
1.1MB
-
MD5
a8a0cf7dacc631b659a49928caab4bff
-
SHA1
23806c93a27b6a4e7ba07faa15c90cf94e611309
-
SHA256
7630a12359a46806fd7136d9900fba44a2221ce67ad7a31007c3857238b6d3cc
-
SHA512
935c4f34c18d7672c02843849091321f30cbd98f7b75395f7389f10510b9ab94e251f9c61e5653fd954145ea0da82b307574decb36c67d7de5220aa683f52d1f
-
SSDEEP
12288:GkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:GkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7630a12359a46806fd7136d9900fba44a2221ce67ad7a31007c3857238b6d3cc.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\yPxjQ05x7\OptionalFeatures.exeC:\Users\Admin\AppData\Local\yPxjQ05x7\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\vhybELCv\fvenotify.exeC:\Users\Admin\AppData\Local\vhybELCv\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\fbnP\VaultSysUi.exeC:\Users\Admin\AppData\Local\fbnP\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d845d122459afa3e48ebafec8d2651ec
SHA12e989bb0ce08dd7d7552292e12baad81b56312e1
SHA256b625b69878962ee3ebaa2863af55ceca422911561fbf2ce9eaaa8a81c3b0d38f
SHA5129b7de9c9d614a4be5089d78530dc43ab993984a403b3268b1289107d52424e9c8f8a0b42e40c0964dd6795d7d9b83744940bd6783dbab27f8967f17d851eca82
-
Filesize
1.1MB
MD5120858ef4d5d9378b98e4819e39a7434
SHA1f9b7f2a99c4341f256e2bb4857cc53f45f03e140
SHA25626257e9c986d547c938c31f26c91b9f2df24a560737d0785de10ffc7c99bf668
SHA512bbde5ff5042343ff36cd139a472d4a8f5b50bf74188690cdcbc8a171ae92bdbe57c927ddd67b618f20eabbdbffb8d7efeaf59cf697824783711c8ffe2667ce29
-
Filesize
1.1MB
MD598acf0175d2bac6fc0285781785e666a
SHA1e3a74deb03210a2a248101b8c823b3673d17382b
SHA256cec47d94e30bd32c1b2ebbc5f9fefccd71e3bcf3bc70532ac0feb074fc9ba4af
SHA51250d50e665ea8bca61774bf37e0d72c1ffbfbf743d63e5de72a2eb53c2467daf37dd8ce54afad733dbdd7ea6a2c2f42181fd1a9cfc42f2860b1cbe9b7d00d7312
-
Filesize
1KB
MD5b73dfaf67f4b46a1713e82f93a369b44
SHA1e74d6850c497121814cefc7e562b97d4ff341a5f
SHA2560faedf3df1615184ba0e1d8bb68726fcefecbf4458e62dafd64f9944351cf160
SHA512fd55f70cbca10805adc77147e162675f31ad158bd2ddd3d3501545a29538d9b3bfc49f90c005dfa6377ca91f7ed51feee9a40367e9879538b9fb06e106d76fe4
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB