Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 12:21
General
-
Target
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll
-
Size
1.1MB
-
MD5
e6d1c2e5b87a7ed6ba3589239a6f4df1
-
SHA1
23b73577254af4ca38171c0414b44bdee8980c50
-
SHA256
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b
-
SHA512
9c6be91ff095cc8828ae4aff713ceb20e098f81e49ba3a2e61c16b9c06d99bfb14604e5074811d2a0de176748b96a06f72ad0a3d3e8b21827d43eb087b1ecae8
-
SSDEEP
12288:4kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:4kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\qsjhvB\recdisc.exeC:\Users\Admin\AppData\Local\qsjhvB\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\kcwG2\spreview.exeC:\Users\Admin\AppData\Local\kcwG2\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\zaf\Utilman.exeC:\Users\Admin\AppData\Local\zaf\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d142f2a4e53af3eb929db7ad32fda2ee
SHA13a2289498cc60b53522d56246af6e051fbcaf8ae
SHA256c2a575aeb7ef584413cd5ff598aa3a6dbde3c9692a87d9e265b9177a3f72fd20
SHA512c743fe2dd1995890e4eb3f8c85592d608cc92657aae1e4595be48525e87cdb88f7735635c023213f1f8d39ebfb322beb71790a9d5411ec90c4535c7404673dff
-
Filesize
1.1MB
MD553b715f92a37b9a14a529f0ce97deaba
SHA1b263f3fefc97d8d0b0b6078053c44c4340db0dc3
SHA256ea706ba8fc90120c79e2ba930334551faa8b6df111199c33ea981233a3939ea8
SHA512677e5de5a66d7fb2c7b6aaa2234029841ff68deb097f52d7cad019b1e50f665f9b720b36648e35ba14d34f1555983a6336c97c522a246547fcc7f19830337db7
-
Filesize
892B
MD582bdf4650805fb8dafe3f72eb0e35699
SHA1820f0400af6ff4c2988e6bc2d69dbfb50e57af06
SHA25667f240613125c50973912947b69bb3d47c76ea11fafbea1ab8626e093b9b9904
SHA512867379745a796716a145b68f6390ae8ff7fd2e7055a7c56d7a516d3da3202837547bed9167599969a235fd7c90cd46cbdebc2c09d5110a17b6d122c4ada3a5c8
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
232KB
MD5f3b306179f1840c0813dc6771b018358
SHA1dec7ce3c13f7a684cb52ae6007c99cf03afef005
SHA256dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0
SHA5129f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4
-
Filesize
1.3MB
MD5b4dc6207c79b4219d594a4b594f940ae
SHA11a6c6c5d7c8e29069bc53832fe5579fde6e6ffa9
SHA25637836c26b1b2f003dab34bf0411bc8b8c276643e8728f3e82ac0e10913cb9abc
SHA512d0f825fcdd58b0c698b0a4f8f1b8f1e57c19f80baa6ad3ecf3782fcad7f7fe1e845d1405853d3ef25b7456fa2e069f3a769fca7960448f612f807cec608392a0
-
Filesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.1MB