Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1.dll
-
Size
1.1MB
-
MD5
bd5c5e5fd3ccc87376233a873effa08e
-
SHA1
76e9011550b052c0f12294f12fa77fa53e7b309e
-
SHA256
0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1
-
SHA512
92c6e4b56d30701b09ebdc414a8547cb41a09fa16c390d58663b2b5e861e3dcb608adcdd6cda3fc01c10fb38ca1b4d4f72d062862e9617a14eaff670c28a3cf3
-
SSDEEP
12288:wkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:wkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\roGI\osk.exeC:\Users\Admin\AppData\Local\roGI\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\SdCu0xz\UI0Detect.exeC:\Users\Admin\AppData\Local\SdCu0xz\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\vORWZFdg\sigverif.exeC:\Users\Admin\AppData\Local\vORWZFdg\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5412a486e9fd095fbe5f721517f7c8196
SHA1914d2f8b39dcb1293ef2a162d725f4df5e92f960
SHA256486fcc5616473ef94b0e6c8b166898687bfb60608507ef9029e0b3170a67bbc4
SHA512e1410549d18809cdb4bfa3ba491713da82865e91a49d232dd3a8ffca47f2eb22e06f020b70988f7be35d50c972e6604d9572acbd16f58d410763f720219b4b63
-
Filesize
1.1MB
MD5c1e00943371d5f22f14b5a47efb47e51
SHA1a2e84d5cdbefbaa563afa87fe106c488b03f562d
SHA2561e5d0efd81e4aaa11420066d163542131f365ddac70c300c00d5f83137b61757
SHA51250ced53cfd2e6b79e9590d623f4ff91d1e650d201c8d1940495ea8533bda6c5931b03952662185bf365dd92347b9b08f3d6fe8a1dbc5e62301c9ea6e6ab0175a
-
Filesize
1.1MB
MD5d448ee05c3031e3e9d32ac4869d52038
SHA1679c307850b10d934d95c703be7fc06d338ba709
SHA256b549d02789bc9372506b286bd61ffff0026150a7e4b304e7efd2847fd06e532d
SHA512e9af5ed7927bf9d09f819fdd82795a40d93f49547bd29842f55c611c737f480dd07d08227089e51d9326dda6b90a3019d24730995967ff8be7c010d5df780616
-
Filesize
1KB
MD5f503e0c052a6119e04f6d77516580327
SHA1364122a6e58b32e667ab8e0a6ce1d3898f4e7897
SHA256e5fa257c02acd17e7e331d8ac0befe5b344257e0e88a2b4c78d754023d5a0c7c
SHA512f7cd5973293b58179db101872125f7894d2a0c85a152ecba412126048b937ce02e2fa2c33c233195818f0043a651e5918f6834df025e571fba596f3ce02dfa17
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB