Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 14:29
General
-
Target
0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1.dll
-
Size
1.1MB
-
MD5
bd5c5e5fd3ccc87376233a873effa08e
-
SHA1
76e9011550b052c0f12294f12fa77fa53e7b309e
-
SHA256
0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1
-
SHA512
92c6e4b56d30701b09ebdc414a8547cb41a09fa16c390d58663b2b5e861e3dcb608adcdd6cda3fc01c10fb38ca1b4d4f72d062862e9617a14eaff670c28a3cf3
-
SSDEEP
12288:wkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:wkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0bc57ba35fdd2ba7868a82512650b287f7168d52d25c4fddb8b423b773eaa6b1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\4i30G\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\4i30G\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\Tai\Magnify.exeC:\Users\Admin\AppData\Local\Tai\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\PJt6sp\OptionalFeatures.exeC:\Users\Admin\AppData\Local\PJt6sp\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
1.1MB
MD505bd8fc5ee1ba42f6401fee90fc7d2c8
SHA1277f2a3ee85248df041603c8f7881c628314697c
SHA256aca3619b58a1184662feb3c6b2b75c9bc8dae9af6c7b16f23f05c240671e87da
SHA5128c880b92495368c832a2e1e51bb4aee7e8a03a176456589eb3a4eb039d2c5cc581e1c0049a8fcf2cfcea825a04f7e563646f3873b28adcc401264c69f5933534
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
1.1MB
MD59ee0c5135a9a6dde58964d493c75d8d3
SHA14e30db6f855f4e381cfe47208982dd568bb5f070
SHA2564ba2535b8d0da44dee983390d4e3a5369b6843959f7c22e58e613aa3a83c98a9
SHA51244ce56d2db7851c9ef71d78a33ee043a44168aae30dca7e0df36a159147d5e8594ea2cb2470bb852528ae56168cf46901478885ab992c7fd9754569ed4a4b35e
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
1.1MB
MD50c5cbf82417c15c0e2f7f973edf628f6
SHA1aab771c137f0405a7dc2902a5808c4caab31c2be
SHA256be8a86e73899143091f879a1a01ce0c2448b3296b0d9df064ae2c9155bbb3097
SHA512fbc02be82381d402ee94475119b048f3b1098020523e9909a1fa7642efef0484207653ebe48ee5ddea99e3d32d7bd2b76eeae59498da28d377d67cdfdf1c8fe1
-
Filesize
1KB
MD5458a7b61ceddb27996aac1877fbab376
SHA14841cba426335587656b293c6d61a7ea881ffcd8
SHA256c2ed2d2817a42cb03c396f7ba7a59b617f8d07d45945d59425025b69bc5f55f1
SHA512ae0d8e8cd3c9bc9b92d0de329405d372d05740617d22c4044833e29bf9b76f862cd7fb13dac739f3dfa02af96539e8265c6633701213c01840dece52b58f1aae
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB