Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 12:20
General
-
Target
a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13.dll
-
Size
1.1MB
-
MD5
a4b1c110a484ba5ca47588ea117ce092
-
SHA1
82f5efbb7fe1cb100d0521e64311c97ac771a875
-
SHA256
a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13
-
SHA512
fd2bfa5c05f51a8aa9ad3602ec9a6fabfb1178d42f80113bf19700260107415dacc1b7e6d7dbf3b7e2a65665f3b3776b30403f791040430c632224bb3d889309
-
SSDEEP
12288:nkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:nkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\VMnGWQLc\recdisc.exeC:\Users\Admin\AppData\Local\VMnGWQLc\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\obONd\VaultSysUi.exeC:\Users\Admin\AppData\Local\obONd\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\5YJXCDEb\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\5YJXCDEb\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD522f83ddf303f133121deb79d235d754e
SHA1cbdeb0d10166510d4663c0ae9160f1c74fb7d5b2
SHA2569adcbca5fe567ed9afa37e2a25c697cbcfbe7e68317ccefaa81a1f2644f9bdf4
SHA512ab5b20186348d48d6613c5103516049984796dd95cfa6de45ad4862993b1877db3f22941aa6e46194e4197bc691d631f2c9886fdb3d80814c15499bfa290dc7d
-
Filesize
1.1MB
MD5bb213261c4550594e2f6a6a69de6c9f4
SHA1d95e4ed3802b46580ade9aaa6a5320628d12e8f6
SHA256b7033c6a607365c804f91df710eaaa9fafd5a8be6fc01f4f37d6c6d0f3511a05
SHA51285825824d3ad263d63335744486899f8e04682858b912aa14bc4f92b540a43f121d2b832c9ce7254cf24865efaaf6e2e544974e165761c0752a6fade88e945d7
-
Filesize
1.1MB
MD5a342fc3a596d92235508dfa79399b924
SHA1eacb29eb9a9db8a074a0e3faf24721d3584357b1
SHA256c10d3fa72bfdaca425b767f372547315fec7191713656219ca9684d1cbf45250
SHA512cda4d581aab4e729f47d1b0018bbe18e5a47dbe0d698655fef48ee38a4c0c33552d04925ca0769648ef95c2ebe94cd52c49f4f240211d0e1ed09be6f4cc38459
-
Filesize
1KB
MD5785813f817d26357f318c7c8a2bec774
SHA12bf8588734821d8e19f5cac8810e7333358aaa12
SHA25638a7fa5567376bc554517c349a88b67f55e78f820c5b988b62f87eba51f504e3
SHA5122adb02f81bf1948b1ea6428b5b80417bd79c7b8e4a3c5ffd0d6f7031a2b3b2c887dfe5a729cb6bbf21de631f73af122df6f30083d26fcd1c2d2a464140a5cbef
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
232KB
MD5f3b306179f1840c0813dc6771b018358
SHA1dec7ce3c13f7a684cb52ae6007c99cf03afef005
SHA256dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0
SHA5129f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB