Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 12:24
General
-
Target
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll
-
Size
1.1MB
-
MD5
e6d1c2e5b87a7ed6ba3589239a6f4df1
-
SHA1
23b73577254af4ca38171c0414b44bdee8980c50
-
SHA256
6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b
-
SHA512
9c6be91ff095cc8828ae4aff713ceb20e098f81e49ba3a2e61c16b9c06d99bfb14604e5074811d2a0de176748b96a06f72ad0a3d3e8b21827d43eb087b1ecae8
-
SSDEEP
12288:4kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:4kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6811fbd0b434eb5dc240aba573f8d5b39e52171d540b372841071d156328135b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\OQJDD\msinfo32.exeC:\Users\Admin\AppData\Local\OQJDD\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\ULzKcC\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\ULzKcC\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\sChfc\dccw.exeC:\Users\Admin\AppData\Local\sChfc\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5367095dd230858cc92c296542ecb31a7
SHA1274d074d9324caaec11a47b62f64687f95228851
SHA256789fdec0eca28ecd6f235521ab87c2e10e9aa834819cc5eb12df0d5d3a89cb9a
SHA512c029a99e2a3aa7bed723952c96d836e6d6183c3bf47244e7d7cba9ef7bfae727f0e6b6e764353849a5a394b68785a4c8102b6eb1a881ce41f68cd208dd1c3f67
-
Filesize
1.1MB
MD5ea724deef4e968dfe455c2f0d5c817d3
SHA1481baff3f6216324719fb7fdd411c98780933cda
SHA256214558365b0931405985fc282e06cb1f90287c2471eed1e3b6ced5d73dbeef95
SHA51229e6da09d15030879d8c6e62c1d59cf9fb1518c7c13b47c5660781f5d8368d81416d0fe2ea3d78d7efcd66e7dec72080f3fa7561bf8c7c74145714f3f8770c4e
-
Filesize
1.1MB
MD5a8bf5ba4ef1707c07f99f6abef5b9432
SHA15c5e3f38cc8d632267eb0aa375368c2e7352c58c
SHA2567b5a16d1c0bd4e0c09f9067a70d930af705edf91270a5a79419ea50286dc66eb
SHA512defa6cce5ac44ecf3ec91d6cd6a0f742a0a5b315597bba73ce627c938a76cacaa6bc7c38ada725d90d8dbd4b16506960a49f9beed240f00b1768e61b92d8e2f8
-
Filesize
1KB
MD5ded051e73bb404d3ac502e13b256b120
SHA1a3d78456a098575329075cfa54bc1561232aa3b0
SHA256a6e2e981d84c2557d86ad627f0cdcc5af8af0d130f3be4c07ab88e09be590ea9
SHA51239301e1b26ae9486d797ab1fd8e7c1ef761b3874cf482092fb784acbd6abb58ee7d937eae42bfe78114f66b794c3c2ef31c23b5ce073d886cecada7eb1aab0b3
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB