Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 14:23
General
-
Target
a52f659bb3d1b5cf058752c904488078b1dab05992f21b858129a829429c279c.dll
-
Size
1.1MB
-
MD5
a44d3f9481fa8b38391601fee76a5809
-
SHA1
60308d0829cf769f88725debddb0c89bbe296e11
-
SHA256
a52f659bb3d1b5cf058752c904488078b1dab05992f21b858129a829429c279c
-
SHA512
304af4426f721ed5fc5bc982a120e07b108a31317f67683de5997fbc3cc87b5d34e74662aaffce1ae0d7c86a8613eb152de71c3fd8d069cc209fe990bf42c3c4
-
SSDEEP
12288:IkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Cdw:IkMZ+gf4ltGd8H1fYO0q2G1AhW9
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\a52f659bb3d1b5cf058752c904488078b1dab05992f21b858129a829429c279c.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\HCoZ\ie4uinit.exeC:\Users\Admin\AppData\Local\HCoZ\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\I4vDLz6\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\I4vDLz6\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\ntVZS2lJ\iexpress.exeC:\Users\Admin\AppData\Local\ntVZS2lJ\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5b009d34804d98b837d1353cc93f3cb8a
SHA14d27ba6a6bbb92aed917d2bb4904ba11bd618b2b
SHA2564de95dd94e8197d706cd6a93bf9aba6cc871307c087b778a224af06611a7c7c8
SHA512c503cc4a47296449406c6c4de9ea4c69c84993b013e12b62c09ea117c6b5b068518d4e3ad9ef5b1673bd67a13963275b3a94e652e26a82f9460d0ea96b6887a0
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.4MB
MD563a1619d6805b8e3ea889fef4c234c1b
SHA1802d4f9ba1154afd164c20b9255056e6a5cde86a
SHA25624dcdeb7f92bc7981f7c8baf079e58293958587bca42d0e8789eabfd5658bc6c
SHA512cdcec43535631efba7d74f17d1f08f62d4c5204e8fe2d01dc538d8bc011f50a177085c342ddafbcc11e33fbe80215938c14c35ffb9807a1a9bbf6c9ab2ec4e41
-
Filesize
506KB
MD550adb2c7c145c729b9de8b7cf967dd24
SHA1a31757f08da6f95156777c1132b6d5f1db3d8f30
SHA256a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec
SHA512715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0
-
Filesize
1.1MB
MD5145e3f24aac0187498e6b50b63e9fb3c
SHA1cfce7c64f444300928c7fc866deb6319e4db8144
SHA256c927423552943630ed3b2523ada240b2022a387721ab90cd0bb86d7b6d690f77
SHA512549698a7e15d665963c7fac627d201cfcf03ad62ce0482f1d3cf5b8930fdc0daedbd8e17cf26c75c7435d33c5c2b57e6bb0ba29b994e9cf529920d950222143c
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
1KB
MD5394cb632a22b7df8e61f09631497b308
SHA1f387198d9b659e715276f5f67bf3d38528e71d87
SHA256adae18ff3eb27c18caca0819d45b7153dbfe642d7016bbb3f7e974ee590ba02f
SHA512504769ee104ac8c29206b5028096014d2743cb585dc420d994cd1767922cebecb6671fceee787b2fd8124a3b388928e5a29d95ce6f7dbb788d35c0ccf4ab764e
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB