Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 15:17
General
-
Target
d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4.dll
-
Size
1.1MB
-
MD5
03ba8398a126fa806383c66c8d69ba43
-
SHA1
3c3d0b73ae14fa215b32418adbcb836addd8de29
-
SHA256
d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4
-
SHA512
1b154d637599acc42a07a5dcf2deb3c1dd5dea933fd40f7f1adeb8876adecbf78d897d44fc819fa9abb96f6d96166321b33e8162004e611970b3f3a360b22fac
-
SSDEEP
12288:EkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:EkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d3520a682e5bc9190f954ecba113c31ae5aaef3cebdd5deaae12a5845fa449d4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\xBOOj3Z\RecoveryDrive.exeC:\Users\Admin\AppData\Local\xBOOj3Z\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\4EmKTZD\bdechangepin.exeC:\Users\Admin\AppData\Local\4EmKTZD\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\KF1og1\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\KF1og1\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD57d836121be6a81d82aef271871bc3264
SHA1190ea28f406f94e4d393fa1f522010e50b1b2e4e
SHA256a77e62956647637e8b93271c283fe765ebe028d228cfd3c71dc825002322f957
SHA51290203645f6a86472021cff3f525891e5ae7b2d56ef06fb8efe3c38c3e5ea886f916995013d4e94e58be799c71ebca08b3537e94e1e3b8b8d3110d97d07a9f57f
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1.1MB
MD57aa012b9256fcc87bc0341d38b9618db
SHA1545149f9ea47f6efb06a460862f532513b0d1254
SHA256329d07064b5864222dad8ca83a9b3c46bcff304656e05b2c1c3f5dd9d6dcfc3b
SHA5128b5328a6b795f3140edab3da5cc2a27aad643b425cdd89344ab822b28b7e235c31cf2241be53477f47bf05851b20002f81a0ae23499c1f3a3725be518179c3d6
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1.1MB
MD5eebcbf8b655d9eacc59c7e9961c19a9e
SHA11dd54427fb929939bb646b03e85c909ca74ee063
SHA256b9a5b21e3099b8471c71a1d3cc2484c00c471233de5c9eba702114d12a348ce9
SHA512a183ba4f18e2a2544de624bbb8484ec67cfd33f5a8b10defd29189767b30c3f1949b56c78b5addf45cdd7fe1067d7d474e6c4a1d7d9711a7cfd299c24e877aa7
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1KB
MD5e9c51046f20b4bad8ff485f3e488170f
SHA1c8c6a220699888bcd6ff03d175f42ef869915bf8
SHA2569024e52c209d79172929daf6357b00d00f2e83b940839e7b3776b4bd71d9d491
SHA512cd66f480824b40faa08b8fde73400350e8fe887229c04f425b0be46e40981a700c4c947ae27a930b466a1010feb16b81ecccfbe3e3721497d728063e95ae462b
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
64KB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
28KB
-
Filesize
1.1MB