Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 15:17
General
-
Target
c946e6a44ce5bcab9b3cf3445cf5d40c1b6e11dd0b3801d59c018c618be151a5.dll
-
Size
1.1MB
-
MD5
ad47ebe3d5bf4dc326457e5c3e8fa3fc
-
SHA1
47d7974b29f1603725a93cbc513044cf72c4a331
-
SHA256
c946e6a44ce5bcab9b3cf3445cf5d40c1b6e11dd0b3801d59c018c618be151a5
-
SHA512
6620fe7a1f4d762d8e5a92cb7b71490b56bd2814c50048ad72095dc9299eb7bfdfa78b2a2e647215086f45327398dd27d73a9168cd8a9a26ddcc7be44cc04fa6
-
SSDEEP
12288:SkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:SkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c946e6a44ce5bcab9b3cf3445cf5d40c1b6e11dd0b3801d59c018c618be151a5.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\csgnT32\SndVol.exeC:\Users\Admin\AppData\Local\csgnT32\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\RLKVop1nf\DeviceEnroller.exeC:\Users\Admin\AppData\Local\RLKVop1nf\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\7yiRWC\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\7yiRWC\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD579f0579315a7971aa2ecc386f607acaa
SHA18b1e97183dee39ac8ff6ed7e16f9db7439ddd8d2
SHA2566611efdf9212b75f29c9c667ebfbb5489aeedce90471fca00a028e5f890a4624
SHA51210d737bde48644ac82eaf613b2cbc937903ff534aa225c53c10f5807ac5f1d34e414e6bcf9e6fecfcad741c5f5dc828e7974ad63208f8dc36983049202348e6b
-
Filesize
82KB
MD5fa040b18d2d2061ab38cf4e52e753854
SHA1b1b37124e9afd6c860189ce4d49cebbb2e4c57bc
SHA256c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c
SHA512511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
1.1MB
MD58257677e718cd9665597cc429205685a
SHA10e379b4397961c061731d9885a1311aef45174e7
SHA2565aedcda3a085ce918b1c769e8d4a4be7a1269292a9111f11487e772956ee6bea
SHA51208c9638496cccbc6a0631cc58343f9cc0588d1c26c5b817a9fc12aff6508741965664d55f9c2e40dfffca2f5de1ad5d9fe692b1e021ec9c753ec8d478b769382
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.1MB
MD54da3577db3bae7c4019561199647625f
SHA1d209a38624a09061bd5dc9c944ad67601fa61513
SHA256cedc9391ca79635e20c3da35c507884fc182aa68c310749d6a89ca7503aa42fc
SHA512d0c44fc3a4693bb1969ab3d46924da7998c86fd9502078d2288a7ea63fd64e5c4d833200b2988d70f4ae2f9b99e4b451e30c6ef974dafead247c580c8ee9110a
-
Filesize
1KB
MD51d73318e0d21afb14b00095f8b837268
SHA11d2616d30e1c0d7995e18578d433f4907cf9f89c
SHA25698384cce011e0b914900a7400eb20edbf6e9e6fae2f6e54371073cb452644670
SHA512fc176b0c640bab7d79e45e5494b0c7c3657be834c96be873badc9bbb71f90e540d0ec7e044f5a1e31ce05f0870ffa9a06b6b18acfc2e50664d6b03770f9876a8
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB