Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
2c7566a218824ff9c74582e59b3ee42f1c5c780ebb721b145e05baf2b36e499e.dll
-
Size
1.1MB
-
MD5
41f473abe15c43835fe74461cbe40ee7
-
SHA1
e15b1de311c779e53e83c87f743eb710d660aa91
-
SHA256
2c7566a218824ff9c74582e59b3ee42f1c5c780ebb721b145e05baf2b36e499e
-
SHA512
7dab20ca04e4e3e517c255961c8ac301664e8e9b48e9ab0d2f012b161a2a88422d597c8a9ff082d4d50d58c2c57c1c340390720539f8188e845d92b5e0e7ec70
-
SSDEEP
12288:4kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:4kMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2c7566a218824ff9c74582e59b3ee42f1c5c780ebb721b145e05baf2b36e499e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\RQ1AOh\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\RQ1AOh\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\CkdlYR8Bg\fvenotify.exeC:\Users\Admin\AppData\Local\CkdlYR8Bg\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\UtxSpQ7\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\UtxSpQ7\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD54ff5c9cf756db7bd9abcd9599a8ddfaf
SHA164f33de141c999cccc3074f7a549dc98fe28a7c5
SHA256589ab1c3f6c4a399a5ee3c649ea494b3689923e88df94146dcdfb8828a859780
SHA5121fc71934be62ca6e35da227b468ccc0ec774d76dbb9697ce9237628751bdd981f100b90049dffe29887dc87c5d8f97228cf98f0e3c006872430a6fe039042aa4
-
Filesize
1.1MB
MD5d3e161e870f681460991e2518bd026d8
SHA10cc9e72e9d51af74a338a7d7c7c33a303731f625
SHA256c140a443200ad4e7922f68c6459ff9ab0aebbb23f0fe599074dff1ac68adb024
SHA51266a00f83177c77b4ae062e0674acc29515d549a68f955a2837e8b28cb7b523863d9a79a3e95eb0dae8b85334dd52b91db23bcb0998d1f0f7049764f4c75726d6
-
Filesize
1.1MB
MD54f64739ace6b49c7adfd4d89e828a63d
SHA162b349af0ffa5fc9af3be337ed963bac76b3e75e
SHA2560dbcbcd407b7d65244efac2b62cc4bcc02f170be3f99ed8edec3954b42cb0193
SHA5124a8757fa3e9d52fce75a2472cfa81100c0e61bd285ed3dbcce84c70e14150a362a30238e03cc50fe3f892471234ac4b5f5e5659b3ec6a41f57bbdc40a9a755dc
-
Filesize
1KB
MD5b76fe9fe33053c6243f4bb65f3559033
SHA10c0163ae1291b7605cea4f155296c3e0d52f3207
SHA2566d8f21f172dff0876559d5ac5a60f874a0b08053eb2940a54031938bfbc9e841
SHA512c58bee8b3a64519f81e36708a9f9ece6b2e23681bc66904511ac33bedaf518ebaf90244de39e5969f871cfdbde2a4169a5c64c2025465f5df4227c8b8290b502
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB