Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 14:27
General
-
Target
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll
-
Size
1.1MB
-
MD5
406c44e26b3195a9d4fdc75506e5d5ef
-
SHA1
28abcfeeda814a917380d166fcd0aa8671fc4628
-
SHA256
4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3
-
SHA512
80f7ea16ae8b1c674c80f87da2ebfbac1b4f952eb382e6ff2b7e2ebf53a7088ef13df3d92dad5aa15d698f0370138b784dc38f3ba3d02211bfc6eb42e6e780f6
-
SSDEEP
12288:hkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:hkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4bc9550e00f42cfe69cc3750a41fc7d91ddcf9a48017301742fb8f4ba472e1e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\1lCAYEQ\shrpubw.exeC:\Users\Admin\AppData\Local\1lCAYEQ\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\JvHx8gcP\bdeunlock.exeC:\Users\Admin\AppData\Local\JvHx8gcP\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\W3iVJsR\ddodiag.exeC:\Users\Admin\AppData\Local\W3iVJsR\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD59910d5c62428ec5f92b04abf9428eec9
SHA105f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b
SHA2566b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e
SHA51201be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb
-
Filesize
1.1MB
MD5c98791109886203635d1ee1643cfdbd3
SHA1a7adb43f98640f6a413b69065a0965ec8337b153
SHA25667c9b8bdac8c95f40860f04210c100d5c9d6f77a4d4b6df03d27a8393bf57e5c
SHA512404dcd7682b03ba98d98b8a122005e9a2083ecd6083a542c4febf669caa06173a2c7cfe998c0152fd8cdf1743fd4dc802431ce262c9726a8a4e27c0842cae1d9
-
Filesize
1.4MB
MD54e563469e10f7031b6c763afaf2e9662
SHA15a35daf09d0e2295964f869f89301909dedf6966
SHA256951fd8a45508ded8a67715b016e7f610787228e1fb7627fb322f9529f0f69f4a
SHA5124413ba2fa66fecbc5d841326db644af5fe13d34af3ba2dc5906ea4f80ea26a28ebeb9c0e75b0fc0fe7b307ec5649e1117f23ce57f1a5893ed1e516485470e80f
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
1.1MB
MD5c2e630f386bcc0440925b3dfefca6fe7
SHA19692c4f45f3153c78067bbbfbd7dc9fbf4c1ffcb
SHA256801d61f01af48bdec6daddfe24dc3ad0bfb0729c056d81b24bc5c2b8ca324768
SHA512e586ed47f2655ef4c30fcfdad55b45b4e74523d184fb7ad8ac2b67c7211e282939530fa501990f7423161e83ce56c97722d6bf4a47392ceecb8712b8df00f559
-
Filesize
39KB
MD585feee634a6aee90f0108e26d3d9bc1f
SHA1a7b1fa32fe7ed67bd51dea438f2f767e3fef0ca2
SHA25699c63175504781e9278824d487da082da7c014e99f1024227af164986d3a27c6
SHA512b81a3e1723a5180c5168cd7bb5181c631f4f57c59780bb82a502160b7874777f3eef1ebe1b14f66c97f9f1a4721af13b6fbcdff2045c8563c18b5d12540953ff
-
Filesize
1KB
MD53101bac017c86d41c90786e874ecbf35
SHA19b6d453669fe1a24aabee445a2fbfcd57480f985
SHA2563ce7b115de61643f2ff01349462e42d88084b8ad29b37a4db088bcd56ed81849
SHA512a5692a46e211ac41d186a7572e7116b3f749a5af685e7280d9006f3fe351fccec219abc516ca828a6d62c6d14cd435bf99dccbbd32a7d1240dd10eb0345d4b21
-
Filesize
1.1MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB