Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 12:20
General
-
Target
096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0.dll
-
Size
1.1MB
-
MD5
29b4a43d6fa90c2c28824982c991da5d
-
SHA1
f4693227a98c1b9a031bb6ad182c5f20b83de5f1
-
SHA256
096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0
-
SHA512
88fa077dc53d0bef81cdfc3d6da7f44ffc77ca3bdd5fd1818c37c0e9327fdd5b1749945393289b87f7aa2f0a2ddb11b924cea0861e83960bd858f7e353f43f2c
-
SSDEEP
12288:LkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:LkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\096c5233892113f80a9ade6545c751fd5c7e049e3357f0be6a0dc8debd18f5a0.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\6py\AgentService.exeC:\Users\Admin\AppData\Local\6py\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\G9pVhx\Netplwiz.exeC:\Users\Admin\AppData\Local\G9pVhx\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\thGh3oyC4\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\thGh3oyC4\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
1.1MB
MD53a4ae92c58b5ee0f5a96c4e4b5d34fd5
SHA1b2956e2eecd16768dda038a5771d0c8f3c0d3c67
SHA2561e953f0902ecaf17d8053d4b54daa7fa6c5114b6195c8a99dd2befd91a32f6b7
SHA512adcc18a2633c475c2da1a8a60d40e87ada1c4bfe9827bef9b49adad67ca00b248e50096f841b2e1746003724935867c6869db05b732060ddbb3aba41ebf05cc3
-
Filesize
1.1MB
MD50ee91bfdfa7c77441e4292fe2c6c5c86
SHA1d7edb87e80ee46850fbfe7c974b71c2189dbadcf
SHA2566e618d7477eba873d25dca7832acf04b2f77c5a1e2932902bab1d58a689e951a
SHA51210ff91a790eae25a53c9298ca1efcab8a8ada48cb98b412177811f9bef7b8c28a4b4e0d23b899382184b6a495fef1b45a52bdebb00fd8227c7e32fc9baad4bf0
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
1.1MB
MD595e0f89cbd047a4c494071aa3fe28448
SHA151ce52863403876cacbf83690a1535563eb58bf9
SHA256475589030d52d77b5c2c4a1928db8eefb0bc5ccd33bc2bcb94ae0ce3468aec90
SHA512a75e3bdc5697e251bee9265e0cf52542967af2573caebb1c574d2a9c11f70d716fb0430000095657bb9edcc76a61c9709eb9a9767df13bf0cfae553ee0709db3
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
1KB
MD551946e09fe6f5c4a6fc0a3ed99900d36
SHA1d780a037d95f305056050271a713ed0b5f33bf5c
SHA25693bb8c7b9b19f8e1a0aeb911dc24778913d3bf027073faa7a691f117ef43b37d
SHA512b63155bc0ba184ce5ced411ba4d99b9664f0102e9b142c7a4310c5524b63a355197d5e3a04b27bcc74ab7a713a5212f4dcd67763bfd9a9b31d8784f8f7b7fdc7
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB