Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 11:10
General
-
Target
caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e.dll
-
Size
1.4MB
-
MD5
d871932dc35f1e6cea8fe6444ca04590
-
SHA1
76232653612cd8c1d327a368d08d267d538ed158
-
SHA256
caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e
-
SHA512
568e8a96fd8960897ed97d4288b29e420b9ac31503bdcd792cd928571f0c6a37c7d8b5ef2cb2b1d2702e15de9061b01776be72c8a83e10724ea9e01a23b7d6d0
-
SSDEEP
12288:ekMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64CA+:ekMZ+gf4ltGd8H1fYO0q2G1Ahb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\caee6535f291e3a5121d05100e5c5561b9ff1a7369c482a8f051e1223dbbf73e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\Colba6lp\sethc.exeC:\Users\Admin\AppData\Local\Colba6lp\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\UwHx4AsP\bdeunlock.exeC:\Users\Admin\AppData\Local\UwHx4AsP\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\bqRwE\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\bqRwE\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD5350d595d7ea2d74052945c3e39ebd094
SHA119531bfbdee6e1af26d530e77b07f2180331067e
SHA256b6969176cc7280b4bcccdb3fc2829d0ca4ddecf108779ad85c04b3c3160b6538
SHA512c836f2beac9e7cd20f53f807db5d46f152d36461b77b5ffd68d89c8c519f69a9248174e0bb2ddccb20459fca128a4b203a576011e9cc46909965ecac77bb1a78
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1.4MB
MD5e1fe2c4c9097ce091c99b72091bfeb42
SHA1712c1306754ba42927713ed12b77ae868d1c787e
SHA25685e18d899c40380c231fdf2c7cb0177d1f79e6f6bb2ea847f1ee9639235d5477
SHA51270453e363e87f86ae7382defe9e0469e9ffca9c8be18461f2bced2e0da958f1c17d85c8f89576a63f5cb5846f1fd6ac537171dd3b29613a2cab52e20d0454405
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
1.4MB
MD52b448d482f6aece7489498204f4f6a7f
SHA1096f9597c44c2095cb06aae22526d4f5b3359455
SHA256c51a45733b0f0a38cf86721061afbd1031be00db7d9cbffa04a48e88ca155ea6
SHA512703400515de5271bffc80a5023e5f83bb539c56470e5c9764c4a68ced5cb81c5a09a0f87cccd43cddf5460f8802e4b4c6e9a49c59f7a36a5f52f366ddf3ae77b
-
Filesize
1KB
MD511c5a9815a95f1b989fc64559c94e11d
SHA1152b3d660325a987a8abb7e81800682bdc909b20
SHA2569333297be15c3e335ec4801c37abeb29bd17e42cc17e6cadc1134b80a837e131
SHA5125f5463d24edcd03ba6ef45a78dd503d1c3b72da5141ac96ea83b03181fe16549dc712acfe8ca8512c7662daaf8dc1ab1778f4d97881463f37d23a18c34197170
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB