Analysis
-
max time kernel
149s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll
-
Size
1.1MB
-
MD5
406c44e26b3195a9d4fdc75506e5d5ef
-
SHA1
28abcfeeda814a917380d166fcd0aa8671fc4628
-
SHA256
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3
-
SHA512
80f7ea16ae8b1c674c80f87da2ebfbac1b4f952eb382e6ff2b7e2ebf53a7088ef13df3d92dad5aa15d698f0370138b784dc38f3ba3d02211bfc6eb42e6e780f6
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\WKw7\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\WKw7\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\r4aYxhf\wusa.exeC:\Users\Admin\AppData\Local\r4aYxhf\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\uKoyQr\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\uKoyQr\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD59d7ded2d756506828823708c0113d73c
SHA1493531b18f4a8566e985a84e6694cf37fde9e8a3
SHA256136288179008e3ad9a8bb71b78067476d03b7b7c5bac9969743e62af2caa805e
SHA5122c9c9319f9e2884eed2c26165ab0bea990cf4380bdba8d92937bd371b8d9239897c5bdad89f63226577d9011166da2ae786f587ddc58a4b624503046dc40e114
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1.1MB
MD54a851b5a3a09457e6e90bd03d65dd8bd
SHA10eac753028b5c76530cba984a28d598cb629e0af
SHA256190b7de1ba8a7bf30d040b27753a99dab4c632e18060626c3214d565438df172
SHA512c0ad9abfebdd6697acba25a8aaa6c366e802e6aa2cfdb0eb4630eaf937996920262a4f6859dcee04a747120ca7555484063bfe1228675e2d0a1b9a8999eb7954
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1.1MB
MD567bbaabb41cc6867bf03ce812788717c
SHA18e9d0dd330898eee3143516a1b40aab0415648f6
SHA256497b829d52c963321f27d5d9da7a2bc0c26af9137d42680c5f16e0bdebe36461
SHA512c2076ff5683cf3c58c5ef9c44b4ed377a67e8b87a27c9cbb8940fdc71f3fcd1f074d8c341def53cb3470aeb637048522486d61fc3ca06c36e1bb28d4cd9a1187
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1KB
MD5543ef64e490af68525d9659b2cc1f790
SHA1b8ab07192c4b98f26c73c36db2663c3f6abb2169
SHA25650b2ffa4a9bd34deeb07b281d9f4d0287a4ed00a8986037e156a616ebffbd471
SHA5129adbccb66e004c26fe2b8396827fd61e51acdc46ade203ef11f1e575e8da7fad157dc387cce3e39ae9c056b0a13427c1683e3a3dee20bd530f15aa0824c73133
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB