Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
12-10-2024 15:24
General
-
Target
82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll
-
Size
1.4MB
-
MD5
6ad98a87dfac01169872c8d4fcfcf27d
-
SHA1
e5c6476f15f2d64c0626335585f0f18ed917248a
-
SHA256
82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b
-
SHA512
1fef8d13244cf1a724bdac23697f48ba5bfd3af84666d713ada3684d6fc7c1b0dd0ce05fdefc898298e5b1b8986160d85787ed0e728d72293344174696b0257b
-
SSDEEP
12288:+kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Cu5:+kMZ+gf4ltGd8H1fYO0q2G1Ahu5
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\TcmZN9\BdeUISrv.exeC:\Users\Admin\AppData\Local\TcmZN9\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\E9rR\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\E9rR\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\vPd\sigverif.exeC:\Users\Admin\AppData\Local\vPd\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
1.4MB
MD5d7b1bfb281b8d2ab9a0269276da7454d
SHA145836c53f1a19472495e2876ae1a1b09bc3f1a83
SHA2561e2b0ddd645403e25baceb2449d035699dd4b671331882cb5073ad5550d4d8fc
SHA51230259c16e58956b00185cfabbafcb7c841debac56390238f7f92ea558332222cfd1196ab10d3b93aba6cbb6960983d2ca9d436bd9617b8ab3bd05c189f9ee30e
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
1.4MB
MD5657df7dccf24992dc548f8912638c072
SHA1e8abcd5f6a038b8ee4babe72ff69950188866707
SHA25668b564ab971301505063fce069826812ba583bc6ef7058f99d6264b82d0e28b3
SHA5128d91d34ffe5ece8185b024482421332dc03796ec7187c91c8c3efa04f2b34fb5e7e9e01609a4073510df8374104cf35135c0af532519b9218d4460cdb1263402
-
Filesize
1.4MB
MD547d3a0d56c2e3e73fde29b6f5d79d8f6
SHA10da41bdc4f0d78671fbcc2e5609d458c4107cdf1
SHA256a20d7a0fb4716a48522bdda21267c23b2e01ea255151d0ed223c75aabb1b7685
SHA5120bd55a2eca4a129796b064bade99548ec6ee6f6f32e87a13fe0f765dc8ed6a7fbd51651d101644a36592989b8163007e2423410377c0d99d162eed5612983c84
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD5b6a138d70d2438059547663a197e2713
SHA10faeb46021e79a62e44ad0186b7bf35bc545cb9f
SHA256fc4655ec1393e88843f47e27316eb95950376c651474e128142ba080da5248a7
SHA512bd2cbd16f72caab30d7d98cae4537769b6e144180cd4acfc508f4127ce98f0af32785e86386d0af2ed058d40117012e9c93d103c63baebf7bb19fcc918614243
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB