Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 11:10
General
-
Target
9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997.dll
-
Size
1.1MB
-
MD5
cf827ba49ebc6808cdc2946c97e697ae
-
SHA1
79f5163acc6e05138b311d3cc74d4c3cd3dc3d73
-
SHA256
9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997
-
SHA512
d3f7bff530fd6e18144eb544f7ce46e61a178bebe4d0625989f8a50c51ee076f0b41a07d6c5c9da0acf120027173fa18a30571dbe78ad45036410e357ac91af2
-
SSDEEP
12288:akMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:akMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9ab41214f6da199b862e32c80e37be8276ba4c54452ad4ce541b3663168f8997.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\72oR\sdclt.exeC:\Users\Admin\AppData\Local\72oR\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\f4U\GamePanel.exeC:\Users\Admin\AppData\Local\f4U\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\2LaD\omadmclient.exeC:\Users\Admin\AppData\Local\2LaD\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d4c394fa7a52144207c8fd5d48ca0a9a
SHA172acb45917d4a6c8e96ffaceb5126af8f74d3f41
SHA2563cb0cb977b16948ac21fd13666737bdf2e6b788ccc7e371e442adcc9e9be51b4
SHA512972f4cb8c17fcd23f65d5763289e5e30a2900a9f08ebdc787084838f3349ff6584232af5ce5c97e8c998725cf6c469b23fd42cca9e2cae6e76ae52beb48f65ad
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1.1MB
MD51037679752a39329d95323e9e7b7bcb8
SHA1f4eb96176149ccb2b281ab592261aa91e3ee45e0
SHA256e1def73a4d040edb15bad125fdb532375463b4952e335f9c56c6214f382bb0da
SHA512bb936602704599279c0b9af190697792522fbc8ef386241072c8a779a58fc9b8add851cdbfe61c0d16f1c97e1ef5d8ee9d51aa79db149970c31b92d5af764af8
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
1.1MB
MD564f3408ea79447495a3693f08f731cdd
SHA145ff3d2aa02262af6cc8685f07e6b3bbadfce9c5
SHA25622e60c48cad788649d4a6db3b9151fac830939ad4e3ff8ef9806fa879aeaf9a6
SHA512af5c6e2081e0204122c98a053f73726d6334a3ad49d1f2458c8fb40e947a05e3ddce53cedc3b66b8f19b2d47adf36d2e8fb3ef0cb27240fb02485079721b568f
-
Filesize
1KB
MD55345fe2ec7016353ec5de533c468c89b
SHA182a8f37e11577411177f7f558bdf9b76d1109f8a
SHA256f154309a618916a7d0ab5181f2966a703cfd4a31bd49eeb2002adebfb83d31a7
SHA512ac4c18b281f526ad61e0caa8c496e9c58643752c0f15341f9e3cb618ebc83a76fd5da7a42b401aa6e66df2eff65e17324984ce2de682a7574886cb3291f281da
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB