Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 11:14
General
-
Target
67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579.dll
-
Size
1.1MB
-
MD5
edb00c9b061bf3a926d1b0c3274f556a
-
SHA1
b87a8d763f02967934771530826d716998a7bc8a
-
SHA256
67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579
-
SHA512
e0997a744143db3b611519aac784ecec3cab29600f3cd16ec243450333d445698c9b0dcdd1e43fd89bab898d26e65fcf45b3bb6b81d9e13ae4cbf033e15f2a8a
-
SSDEEP
12288:WkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:WkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\67ddb4eca1cdf94729d513e5acbb1d2b61362b9b1824afb8c3682a9b021c9579.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\UMa5Z\mspaint.exeC:\Users\Admin\AppData\Local\UMa5Z\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\xQ7d7\sigverif.exeC:\Users\Admin\AppData\Local\xQ7d7\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\CsNdN98e\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\CsNdN98e\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
33KB
MD50d5b016ac7e7b6257c069e8bb40845de
SHA15282f30e90cbd1be8da95b73bc1b6a7d041e43c2
SHA2566a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
SHA512cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e
-
Filesize
1.1MB
MD598e89de72ad3f01cd896ca371ad06433
SHA13ef4727ceb48b36d7f2887a470069536d77cff31
SHA256722a47e0a4632bd1d17450c10745f328a4ba70f3714707d96fa6411cde59dfc9
SHA512744e9eae45f9f094554342a78de6a569c63f826ee49502cda518425a70fbe4dea7cbc79caa542862d1d74f3138905d8b25414c5b043e6e41072ab85f6d1ed0fb
-
Filesize
1.1MB
MD5af790b4ca1483f45a842fe319d8ae2ca
SHA17358a3c7292b957904067386f71d2591105df1c6
SHA2566774c9993bcf5535d7314b3659320a034075f57387fae7673df50ca25d94c756
SHA5122c338fa6899c4730e26b130787d63c1f37fbd915332f992d9af636d8c739f08c5d1eb1457ca008e4918f6452936f7c48eeeb6a37999932565afca423838979c4
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
1.1MB
MD5c9483b6fed4bb36e41a6b74848515505
SHA1407c54aa0e24556f74cbae6d9ffa4514fbad9b38
SHA2567990b9ab206d73bb689fcdd5cff27125f17af939ea6d01862a8f5c960e569353
SHA512aedb66287e94ed012080ffb86e7547a9c209f4b841fa33c6f529354f57944f18efc3643c16e4d2a2cf50c0154d12d17889ba14c7068873f277d1fe39766cfff3
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD54a0a424e161c2525c2b5ac13bb7992ce
SHA14c805c6b2a4a534b50b830184658b79fadd4fc51
SHA256f81b70da8b96f2e1ad53429d2650a827451214bc8685b87dfa2635dd89093258
SHA512d8fc4314a505a0fa7dd80e489554a28edf74ce286dd148074d7f1595764b7f6b543cc020e54eabfd5c44a064f80f5a1ad27bd92caa65be523170519dc48ad2e1
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB