Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 11:10
General
-
Target
9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997.dll
-
Size
1.1MB
-
MD5
cf827ba49ebc6808cdc2946c97e697ae
-
SHA1
79f5163acc6e05138b311d3cc74d4c3cd3dc3d73
-
SHA256
9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997
-
SHA512
d3f7bff530fd6e18144eb544f7ce46e61a178bebe4d0625989f8a50c51ee076f0b41a07d6c5c9da0acf120027173fa18a30571dbe78ad45036410e357ac91af2
-
SSDEEP
12288:akMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:akMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\fqc9\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\fqc9\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\aGZkv43tF\OptionalFeatures.exeC:\Users\Admin\AppData\Local\aGZkv43tF\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\wMhiBxkGn\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\wMhiBxkGn\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a093dfe1dc1ba7751945066924520f40
SHA11d91ea996bb7fd5c8c33f3d5d658092bebd0e455
SHA256a1c53e0b20d6c711c2c81c90b0586db090aa43867b643a80f0bdc7cd3f4dd1e1
SHA51276ca7de73dc8b3910248be059d00050718424c1b0aae062806c365902adb6c410628907753b9970e570b67a67160ebc342c5026af874ae5521a5b994763c05e4
-
Filesize
1.1MB
MD54592fcf199e0a30ca3a533fecbe8e30b
SHA17bce32f1687fb5df7fd0da6b7dac4674c99bcb8b
SHA256fce76b10d2dde0db2cf3cd840fb9a0b8f1e4a3ba90b58bcc5481294c818634ea
SHA51246b088100519ffe3bce1b46ecdcb275661fff704fea8cec8c818e22def9414950a1df72a9032219876143298b876fd2b88f3cc170059204242fb1982c3afff78
-
Filesize
1.1MB
MD51760c67d64a678fa9a9eb8994d0e5717
SHA1ffba25d6a7c43091c9145399d4dbd7dd0066090f
SHA25616dc29fd6f3978e146a2d322fd81073168419b2c5883f31ede246f630f7b78d6
SHA51241108f2cfc14abb6718131ce39148fd1ea49005a9648041a16aa0f7ad6b0a2744532c91655489d7b4b8b752580843afcc4426b331f5b6519f01b63e88aa80915
-
Filesize
1KB
MD589c4376c05d7c726a04d719dc396b68c
SHA1cb3a100f7a487e862675d2c682ad076146523410
SHA256c6221ee0439b35081e75fbd09888b88abc2a246ef96ea70941fab1fa8ce8927e
SHA5124f56e8f889fca98df563dc06308a968c7c0d467c517aa4df22f4c9b84fc7d79b569977e0286f49c5f2ebdc074c4cd68aeef978b6e6c0db9d4307c0eb6fb6fb86
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB