Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 12:20
General
-
Target
096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0.dll
-
Size
1.1MB
-
MD5
29b4a43d6fa90c2c28824982c991da5d
-
SHA1
f4693227a98c1b9a031bb6ad182c5f20b83de5f1
-
SHA256
096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0
-
SHA512
88fa077dc53d0bef81cdfc3d6da7f44ffc77ca3bdd5fd1818c37c0e9327fdd5b1749945393289b87f7aa2f0a2ddb11b924cea0861e83960bd858f7e353f43f2c
-
SSDEEP
12288:LkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:LkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\GtP7\cttune.exeC:\Users\Admin\AppData\Local\GtP7\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\WAYPv38b\mspaint.exeC:\Users\Admin\AppData\Local\WAYPv38b\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\sWPnD\consent.exeC:\Users\Admin\AppData\Local\sWPnD\consent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c746afb32ebd908f760db317d8f1718d
SHA16653b5e6243a39c1e412c91f94919210ff047474
SHA256e5072341e561fd63d08d3f14caf219ee0f167e4b3d957024c26f43a65df9986b
SHA5123cea5261eb6bd3ece6dd8e43a6021aac5f295cb0d781e37e0acf05d770159e064c69cc545d15e3d6accfed5ff31d821031e9466580019d6ead8771ee2defe7eb
-
Filesize
1.1MB
MD576eccc677a679c8c412b9b715ecc99ad
SHA1f46df3320c5459a7c0ee6653d3c26ce285bdc3f7
SHA2566e3a320f6655e7c22d3a59357608141e1a4c039a9a937d2f803cc9285de86e2a
SHA512fe21a588e7e1bda4b539b5abbe4b073b9daba8891864dae813a39a6e5aee218c16eeb7d0e5293801a960ebf12cd57c700bdc3f9db5aeda5ba7349e73832acbd3
-
Filesize
730B
MD5314871b6af3918bc9d331cc66825c523
SHA19760c4f77ee6fa99245a74b4dfa5f862d56fd5f6
SHA25626e8c9cbead10e61a5b5f6e8089dda51d16469603d79768bc57e8dec80917b49
SHA512501dae852205dffb374ac30ef682ecaa1fe288dc0f7058a8e312d41a0f310126ddee744316f0ea7119f689569a4bf41593aa1badb97e4c77aa3210a79184ae2d
-
Filesize
1.1MB
MD5b9d90510a0b5fac999226a4d55c153c1
SHA1ab31f200c64926b5e2012ac0109a858672104de7
SHA25615003fb1725efe07e514d200a92e1a675de701b3e98025856c1aa11a884b3cd8
SHA512f89f5179f2730bc6ee8b30e18f99862b34a94c3e139fb58d30a2c52f620429dbc8ef211a94c7b38c5b00ffc7c4a130972654be882a63f3ed5d1913a9f9c817c1
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
109KB
MD50b5511674394666e9d221f8681b2c2e6
SHA16e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA256ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
SHA51200d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB