Analysis
-
max time kernel
150s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 11:14
General
-
Target
67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579.dll
-
Size
1.1MB
-
MD5
edb00c9b061bf3a926d1b0c3274f556a
-
SHA1
b87a8d763f02967934771530826d716998a7bc8a
-
SHA256
67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579
-
SHA512
e0997a744143db3b611519aac784ecec3cab29600f3cd16ec243450333d445698c9b0dcdd1e43fd89bab898d26e65fcf45b3bb6b81d9e13ae4cbf033e15f2a8a
-
SSDEEP
12288:WkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:WkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\uLi1Wy4H\BitLockerWizard.exeC:\Users\Admin\AppData\Local\uLi1Wy4H\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\hACPsL\osk.exeC:\Users\Admin\AppData\Local\hACPsL\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\xVJ\osk.exeC:\Users\Admin\AppData\Local\xVJ\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5bde5e428430c4d5a765ec716054ef830
SHA1043624c401a7f39f487fd5d6368783ae14aa15a0
SHA256ada51ca3f48d4a84b618a6f73b94aa8a7076e73c7f6a00a7713ffae9c85ab490
SHA512e06e57236fee4f43f5e92b5320756155ed34c05c3300c17ad23069293664005f4395f0e39fc2b0ca7e8ec31e96e01c285f12027cecc0a161a0a5c354b93f5d04
-
Filesize
1.1MB
MD5ed5606d32e7aa4ac9b19747493127e7a
SHA16f47b7e3ed4f8d2eb9a642834aa4aa86e52eaed8
SHA256b9d0e3449a87674d2d5572f545771d2c65cd09930286bf83a0d34a615f7ba30a
SHA512f8ccefd8553fc7949eda55464222a54a89b8e3901f10dd7f3938c34b152a69dff86bc88355d281a1836ec2509bd643f07cc8bce4ab1156193b450b65fde28d93
-
Filesize
1.1MB
MD5423c8617f835545290dddfc2ffd70ec2
SHA1b8ebeef871f6a3fa6a27b45fea033c3b7ef1b7ae
SHA256324103ee1433f17cb74e348603f937f86b6ee0e8e76517db70410a40d443bf00
SHA512f3478d8658f65d734fbb06d33689e39fa169574c2f9874db2bdde2b1335d6c390f1cdde85cf8b1b797c8f33b8c2629173744315132b3a1cd800b755fb4384323
-
Filesize
1KB
MD581a41062b280a6aaf02eb91a184fd442
SHA153f34243fc199baf77c258c08341ded537fc70f0
SHA256b72a2a4f66040d0983fc750c908c375fc9dcfbf2194abdeaa498907bdc8ba896
SHA512e5b7a90373fddf954f123358e1bf2cc255a3da5c3ba7f31cd2d0b46c60f33bd5961a24561f7de9eaf6343490ba2d7e5d1e2c8bedd07662432676ed6f0e76c5d7
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
98KB
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB