Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll
-
Size
1.1MB
-
MD5
406c44e26b3195a9d4fdc75506e5d5ef
-
SHA1
28abcfeeda814a917380d166fcd0aa8671fc4628
-
SHA256
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3
-
SHA512
80f7ea16ae8b1c674c80f87da2ebfbac1b4f952eb382e6ff2b7e2ebf53a7088ef13df3d92dad5aa15d698f0370138b784dc38f3ba3d02211bfc6eb42e6e780f6
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\w9lA9Jcu3\DWWIN.EXEC:\Users\Admin\AppData\Local\w9lA9Jcu3\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\rnTZnVoU\sethc.exeC:\Users\Admin\AppData\Local\rnTZnVoU\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\BLp\wbengine.exeC:\Users\Admin\AppData\Local\BLp\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54a627bf8491595ec53c686913e221f0f
SHA1617cc29c86c44264509747d814479e9fbd77cca6
SHA25637248157315b8b0d5569bca710ad316e744860801dca4dcfc6852a402968de41
SHA512154517d6f5cad1e1a8e427111da275e8715739dfdaf2f884a2892b2f8243dfa41a35f7c035c4e641cde9b8e3c860cf9a664a6b6693461538e8823bf2ab8a7fc7
-
Filesize
1.1MB
MD5d0f678855b52499e23deeb556674b976
SHA1b4a3cb187a783f0d934ea8630ae322c0e29b0a80
SHA256ad6c967ab584039fbae30c53626d5176467573f21e233718171643870fbc0677
SHA512752c652ec936aa8b45807a4b9d914cdb37332e0351acde63e6bea2472b193cb72469863ecc79cf79357a87848bf37d2b100c6ce5aa16400296e4f9da83885660
-
Filesize
1.1MB
MD54ddec3668d4283fd0447d0a126b5a1b8
SHA187457aebfe01aa8289f9f0fc320d51f6e625b70c
SHA2564f6cc118c70d4e89dcb7769413dbb5b781e636d082aeba75699682aa83997201
SHA512897289925e56257293930503473a2c4d606d6ace8945c2a0a95e648088a00cb8cdb0839836ebae0efd1f32dccac4366cc35def799f2d9e122fd17ff2427994be
-
Filesize
1KB
MD5ad1e950409a12a08aca869f7e920e9bf
SHA1a097a05fe564df40eaa5d93943a3f650fce34108
SHA256ff99ec600402ea863d8bcf454b9ca4757f3d6d0aff276e9c1548b6849dc5bb7a
SHA512834be1223ee9f11d36146c01deb8d351bbf1a0cfda0564bdcefcc7707ccb4b84260e52a81ce476c56f42754df463635b2f771c3b8d30f40b68e4f2686666a5b6
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
149KB
MD525247e3c4e7a7a73baeea6c0008952b1
SHA18087adb7a71a696139ddc5c5abc1a84f817ab688
SHA256c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050
SHA512bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB