Analysis
-
max time kernel
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
29cc676374970636300ec1fe268c10af4871e25f4c9998546da9b6bb849012bd.dll
-
Size
1.1MB
-
MD5
9689001d9fbd08bc63318734814455df
-
SHA1
e115f3a4b3723f3375a7e164356266ab08a88b68
-
SHA256
29cc676374970636300ec1fe268c10af4871e25f4c9998546da9b6bb849012bd
-
SHA512
99d01a67ba2e1fb465aefeb588df89847262bfcb3d8fb839cfc3a93c87f9b88955f94329a462530dacf90b49ffc54a4824e46063eb958234bd3095447ef645f7
-
SSDEEP
12288:VkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:VkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\29cc676374970636300ec1fe268c10af4871e25f4c9998546da9b6bb849012bd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\9eNU\msra.exeC:\Users\Admin\AppData\Local\9eNU\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\0HXwg\slui.exeC:\Users\Admin\AppData\Local\0HXwg\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\DKakWom\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\DKakWom\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5903eb9b9ad94599b079ab3a7424600cf
SHA19fac6bb31d30e2e80e4331005abf8c904184ec0f
SHA2565ce24908fa85cf8cdd3d0efb636f1a43f518c9673ce465bd43fa66e1c3fa1010
SHA512462bb318069d7f8fd8e887689e2b09b717f9fd48d68d3446fe76e2a6104e7dc074e66c5028fc087a7092650634384b018c20d222a60b7b8a668ccc33b4fa1532
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1.1MB
MD5ecc3c69fb0f45a04a935d5c900459146
SHA1c91001852f18147f7389d4fbf7b517519c49b857
SHA256f87be806b1f743c538e10d4c0a0a0a0aa3f3be696c86a74f172f62bc67bd91bb
SHA512782a49297f8cce9e07cd32a5449c94e775f0f109a9ad805f2743dee2cf4d42fcf90199abffa18f322d42dfd1286f4c5bd3e20a4b7d6ff6dd2eae21b66397eeb9
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
1.1MB
MD5b113eb1e4330c3a7250c663aacb8ff0d
SHA113241be322ecb430f803884668c8ceb3b15e7871
SHA256f213f50aee5b4a85c3d44aa5d03fa32614f0b8604a5c30ced489ff9b51a1f715
SHA51284f736baf26bc892b85e0c40df312a194a115c5a34e40c1dc6b047d19f8eb7476429bb95d348f90c9cc4241b97e4a0e5411f36cbce5da5058f12124cf821453a
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1KB
MD5c5995d46ade19927d9901e858db041cc
SHA1e3ccf1c9aa913e93c1d1e6c8289affac8ad0cb65
SHA25664dc3a168fc91c05e217b4db4ff0cf834163b7d71dd8cd6a920af08647e4c39b
SHA51274a09f34a94ca491ae83a1ea4425db264ae59fbdeeeb99c124eedf13f813d2a14f019c95a0fe9ae82d832175372bb45a060478a778694e566cd0529b92e2490e
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB