Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 15:17
General
-
Target
d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4.dll
-
Size
1.1MB
-
MD5
03ba8398a126fa806383c66c8d69ba43
-
SHA1
3c3d0b73ae14fa215b32418adbcb836addd8de29
-
SHA256
d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4
-
SHA512
1b154d637599acc42a07a5dcf2deb3c1dd5dea933fd40f7f1adeb8876adecbf78d897d44fc819fa9abb96f6d96166321b33e8162004e611970b3f3a360b22fac
-
SSDEEP
12288:EkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:EkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\Z55qo9Yv\cmstp.exeC:\Users\Admin\AppData\Local\Z55qo9Yv\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\NTsK\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\NTsK\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AdapterTroubleshooter.exeC:\Windows\system32\AdapterTroubleshooter.exe1⤵
-
C:\Users\Admin\AppData\Local\WIEt\AdapterTroubleshooter.exeC:\Users\Admin\AppData\Local\WIEt\AdapterTroubleshooter.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c8cef1990d9fbef914f9d9dfb7849eb5
SHA10acb4f34d4d4768efa9332f0e0b4bb43cd079a92
SHA256f200fa430722ad574f89be82eb294ecae01b3f3a21f6fc2d3081f6e2d982d808
SHA512cadfcda59ee39decd1957a9759bf62b6888db1d9132906c4690add9b8a59707aac7a3c9c73922ac592a35dcf6c512f3941448e39b5a3a2f9c2580dc9d2a69451
-
Filesize
1.1MB
MD58f3734172c3207c91f490a3ad886546c
SHA1a6668836a2e67dc80a0c44d1cd7b8c8cc73e6dcc
SHA2569bd2144a5b406e013f93a91035827e70ffa3057ddfa8b26140f8d9c5fb6f5f20
SHA512325a6120534e804395bb84526e90447707098d9576c47aa56902ad41f67237bb20a34a5448180e1c4c14899cbfe8a42db641e2729c54b23eddfda5155e9f04d7
-
Filesize
1.1MB
MD5e4dedc20cd9d331a2fcae5d4fa0820a1
SHA1e29bbeb3b9a4fdbcd1bb113ced19027e523233ab
SHA25613cd31e4e8298d61e4b4f90cab1773609d75ff98e7ac96661c734f39203c718b
SHA51284bf8582b7f3b921aa9b2ab20e790fbd285dfbc5da7fee23aa51b19116ab46595b2016313ec8ee3f6d4c547b27b9c083dd1193a25662259b18344f9f7395fd4f
-
Filesize
1KB
MD5035d58bf43d7fd80e8dd74b0d8dbc11f
SHA10821ee4c11ccfa52d6fb6b7fe8586ec76d31f034
SHA25636791a63a81c656e44474f89d546aad21e43574aae4b5c329a8b6e60ee269941
SHA5128a30a9b32764f4eefff3f0bfe46e66cb826f6479bb19739319e97a5a614b95b5e3f02c5846331a58e9f22e0d8f128b82d5d320baf4b6417e67db3c1493c6b769
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
39KB
MD5d4170c9ff5b2f85b0ce0246033d26919
SHA1a76118e8775e16237cf00f2fb79718be0dc84db1
SHA256d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da
SHA5129c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB