Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 12:21
General
-
Target
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll
-
Size
1.1MB
-
MD5
e6d1c2e5b87a7ed6ba3589239a6f4df1
-
SHA1
23b73577254af4ca38171c0414b44bdee8980c50
-
SHA256
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b
-
SHA512
9c6be91ff095cc8828ae4aff713ceb20e098f81e49ba3a2e61c16b9c06d99bfb14604e5074811d2a0de176748b96a06f72ad0a3d3e8b21827d43eb087b1ecae8
-
SSDEEP
12288:4kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:4kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\J7OKE0o\sigverif.exeC:\Users\Admin\AppData\Local\J7OKE0o\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\I3LrkqXdC\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\I3LrkqXdC\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sessionmsg.exeC:\Windows\system32\sessionmsg.exe1⤵
-
C:\Users\Admin\AppData\Local\CLJ9\sessionmsg.exeC:\Users\Admin\AppData\Local\CLJ9\sessionmsg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5f4a0b50aa3fba5e7f3ed8d26b7bfae5a
SHA1198b1bb27bf70bf243e0ceb6c9cdb795aba5e220
SHA256dd57978ae690bd31caea9fba1e3c25e356eb73041b73cb6105ad4a02cdee0267
SHA512a2e20adafc38561a01792af8a52bf9984114a042e3dbbadc1effe90d78b615d2e247f443fa4a02c30577d8015489cdecc8206cf452a4aa7f116bf765c5497218
-
Filesize
85KB
MD5480f710806b68dfe478ca1ec7d7e79cc
SHA1b4fc97fed2dbff9c4874cb65ede7b50699db37cd
SHA2562416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc
SHA51229d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db
-
Filesize
1.4MB
MD5b4f5726821a972b36f530ce05ab9a8f3
SHA1315ab2e01e1440d64d3dda458df0c75dd1d17628
SHA2568859e6818aa58144ea774573fa9dd0e25527361edfec59122aa3b1ae0949dd10
SHA51264e745f9e6a80b8fde6917380666b89b793d35bf3abad0e0a0106fd3023f4e08541bd57fb8f508d8fb881439341023c169ea0616e077a20bed15cfaf02cf9bd7
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1.1MB
MD5ac9e02f3c491d0c132223d9db7a62eef
SHA1c74f57c4ce0acb1e275e5b770e2395e550e5a64d
SHA256edf67c23c4f0b95aaa92de2ab630bcfc8431d404c9f26434850caf9245b414e2
SHA51291da1a3364473749be4d4b620974ad7a47c4d9ddf28ff3cf6513718fe71d0d5c086adb366449dbc2f1e49e51d48e03aae24113ddbe4e5d29d126f2686de2f45b
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD5802ce575ba69c1a4d95dc49ee451bfe3
SHA137bc27720a9ecd274fe7bb6487f4a44dc27cd626
SHA256f89461770b847a0d86a7b472687879248ab39e1620f327de7bb0981df1bdae27
SHA5129b79739b80e8872801e01f3f656ce4b8a4d1197d810d0e374d8854923d8cfaff030c560191c6f6d8b9456654d5bd1409079c21f32c79b254472232604aec1cbb
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB