Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 11:10
General
-
Target
caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e.dll
-
Size
1.4MB
-
MD5
d871932dc35f1e6cea8fe6444ca04590
-
SHA1
76232653612cd8c1d327a368d08d267d538ed158
-
SHA256
caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e
-
SHA512
568e8a96fd8960897ed97d4288b29e420b9ac31503bdcd792cd928571f0c6a37c7d8b5ef2cb2b1d2702e15de9061b01776be72c8a83e10724ea9e01a23b7d6d0
-
SSDEEP
12288:ekMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64CA+:ekMZ+gf4ltGd8H1fYO0q2G1Ahb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\M9tK\rdrleakdiag.exeC:\Users\Admin\AppData\Local\M9tK\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\ph5M\Magnify.exeC:\Users\Admin\AppData\Local\ph5M\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\eNw7A3yf0\rdpinit.exeC:\Users\Admin\AppData\Local\eNw7A3yf0\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD541c0f2e38b70b5b0f8f6b6a4fe429b00
SHA1e071f81c4a0c019c40d2abcb9d54af62b43b8892
SHA256611b26b0ab4bc24cf51fbe463b760b71329bddc79385ef39dad35797775c2c01
SHA5129c2dc4ac8bd8419971a4ba6420b477efcbd0fb3352c5bf83d6bee263f3d530b9ef581ec316fe5660173d8f91a92d61e903cd086b34dcf0c8612a7c766ba55b02
-
Filesize
1.4MB
MD50aa3f7eb33956f294e1e23123c204d98
SHA144807924a50982bc00f51c6fa00bf92597b45041
SHA256698c41fb7f48c93b25b7beee53eaf4ac48896bf9287a3174a70cf3aa6c671410
SHA51229401abf93b289eb4a4bf628b95c98f5493d16c0bea54f41bf3ae7d1cad44850f367c7e6f417dc62ef86c5f7174339df0554692ba02671c03ce6156bd6538998
-
Filesize
1.6MB
MD5a3bcc24779d78557c731d366ce3940c5
SHA15ad50d19eb81c2ac0c8c6bdbb74d6f6ed9851663
SHA2569a6448024554196b84c5f7ffa9bca57afafe69f22441ff41ff6d066d48d53df0
SHA512f9e1244f6598d7f638b1d773b85175419482c368ae2392125dc1c66917446df3afba201f4eb7756d6c84912569a1df18d312a0e10a6f49c5d578926abeba1cba
-
Filesize
1KB
MD54fe91e9164238b75be33e07c212e6225
SHA19d7bed9dc423fd41052a200f0d591f6bdcbf2fc0
SHA256ec327c7503322191e529da9fbb0d9f8ccfbfda54debb85d8ad778124f0a2dfe8
SHA512c1cddc288412045c68d6baa053e44268fd7954cd16e0985dbdf7b3e92bf243c224862f8b0b1f0ce9c09e79684e8b949681ab15bfe93628feaef16c348edf373f
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
637KB
MD5233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB