Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 12:29
General
-
Target
a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13.dll
-
Size
1.1MB
-
MD5
a4b1c110a484ba5ca47588ea117ce092
-
SHA1
82f5efbb7fe1cb100d0521e64311c97ac771a875
-
SHA256
a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13
-
SHA512
fd2bfa5c05f51a8aa9ad3602ec9a6fabfb1178d42f80113bf19700260107415dacc1b7e6d7dbf3b7e2a65665f3b3776b30403f791040430c632224bb3d889309
-
SSDEEP
12288:nkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:nkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a63124e1c689fd3a1bed990b4faf822fcd0a0797b2b2b68609e7d169b494fa13.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\Tri\SndVol.exeC:\Users\Admin\AppData\Local\Tri\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\tuBvnMQB\DisplaySwitch.exeC:\Users\Admin\AppData\Local\tuBvnMQB\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\8UKwaF\cttune.exeC:\Users\Admin\AppData\Local\8UKwaF\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD592c2adbfa28657df469ab3fccb550e6d
SHA1dc729619ecf9cb15f41b97457120e355108d0e33
SHA2561c96069eeb5666ac2e7443452f11c635d9fdb635b8b2af576cb64cfa1b4eba11
SHA5123998a5608138ddecb2cb906d601d0b59defa8286c125aac8736a45741ccaf6fbd59a07dfa4d9ae59cc06be70d0c0f7572e52d846f53621148f04390b0d08bdd9
-
Filesize
90KB
MD5fa924465a33833f41c1a39f6221ba460
SHA1801d505d81e49d2b4ffa316245ca69ff58c523c3
SHA256de2d871afe2c071cf305fc488875563b778e7279e57030ba1a1c9f7e360748da
SHA512eef91316e1a679cc2183d4fe9f8f40b5efa6d06f7d1246fd399292e14952053309b6891059da88134a184d9bd0298a45a1bf4bc9f27140b1a31b9523acbf3757
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.1MB
MD538edeb141c4fb8ce9f034af795149c7a
SHA1f7f0907344592859eafcc52a2c05ab1c32549015
SHA25689f34699e63501a66b7628f33195de1b1a9f05d2db034ebce29d828f9d87df2b
SHA512faa1ca9e33c07890c8cd1749c8a3d0992bc2652c8b8b89e782e8c2f20f95c2c9fef5d8eb137e4005331a7d65175418cc01656b313acc635dc11493cd8340e4a0
-
Filesize
1.4MB
MD5ecf00929ffcc148f80d15b69bd8106b0
SHA179b90e52b9f243addd336c572cf45faa8c5d55bb
SHA2560bdf0f209a054f388327a1dddca3dca152fd3cf1680b67a20a3e7ff0ff80001d
SHA512450eae42fb8f356980f9646080f0db4bf538f96c0f6aa6022c1b9b9adbec1c0cac9c38a080ea117f8fca2dab8de3a172436d57715c660558914fbe4fd2a5e0a3
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
1KB
MD5b9b543af325343fb236589f2a9b91f36
SHA1a8291689d4be578cc5b2ba1cdb6ed42cafc7abbd
SHA2568cd41dd4c5445c63388c5c58903c2de95908ce49b89e46e84c7b5f2801106a46
SHA5121a68070223dd2ab093aff931bc8e8de853abead3cf881e54d7995948e7870c6d24ffe7e75ea330067adf0592fe4f64303d72621a822491ca273c3ae598ae1179
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB