Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-10-2024 15:24
General
-
Target
82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll
-
Size
1.4MB
-
MD5
6ad98a87dfac01169872c8d4fcfcf27d
-
SHA1
e5c6476f15f2d64c0626335585f0f18ed917248a
-
SHA256
82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b
-
SHA512
1fef8d13244cf1a724bdac23697f48ba5bfd3af84666d713ada3684d6fc7c1b0dd0ce05fdefc898298e5b1b8986160d85787ed0e728d72293344174696b0257b
-
SSDEEP
12288:+kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Cu5:+kMZ+gf4ltGd8H1fYO0q2G1Ahu5
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\jw2SdB5\rdpclip.exeC:\Users\Admin\AppData\Local\jw2SdB5\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\tHOac9r\OptionalFeatures.exeC:\Users\Admin\AppData\Local\tHOac9r\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\OnLfgUX\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\OnLfgUX\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5b6f65187b82ac5454deb10c1b9f8dc5a
SHA14dec772e0d34872d215c96c67c0c38b4399532a2
SHA256dabdeffe5c0091beda683354294df5bbfc2ae3516a6ea3bfaf85e6f140b8cd86
SHA5124e184771011fae718514b56a18f8cba39f0607316232937b7f1e5b9e486f01d646e684813628de2810608d60b443cb0e9e525e8191cdc927ff22f28ef84ef4c7
-
Filesize
1.4MB
MD5f0e8b3a0254eed1ff5bed50864365667
SHA1c3558090ea2fe15f9b710343c2680ea2e93dfe22
SHA256069737eb9fe172af84cae12679da9c2ec3acbb1fe1a73015d53bbe7fec5c3046
SHA51233f31448da6b5729df1d5370bec52d18937849322a8e562259d95a5ac34d51975d829aa801d2341924bfab4d8da33b0e58837458eed4f88323a7cc30c979757e
-
Filesize
1.4MB
MD5bb40edfd8a8c5982ded486806258a861
SHA1267a7870f52ccf4ec04ef260af53ab3d3a2d3686
SHA256279ce76506b99783450217b2174b22f2b0a6f7a194a94565132aaa6db240faa6
SHA512e5166550a72dc8cd46e68e4c645beab58e40660afc8b6442c552b1b88107afc166c5a23833eeecaad8dabbfbdcf63f67c89db144302bcfb4f1e2eb691a9b6adc
-
Filesize
1KB
MD503a518cad495b7fd2be0d241c9695de1
SHA14ffeb0f4c3db7105a84b2bf5c697307c68b904e5
SHA25653432a2ea2b0c527c86643d85f8b79caa7b75c88e3f3629f4f09a86c25c35a7f
SHA512b14b5efe1a5993ac53bded1f063fd1e007dcb468b2764bdac01e1bbdc4b46a79ce32d184f902361b27aa21e2e6241d9cf9b394f6f0e837ff3c9b4c28a4d1900b
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB