Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
14-10-2024 13:08
General
-
Target
bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a.dll
-
Size
1.3MB
-
MD5
c593d8b78e3dda17474751a9a73f433a
-
SHA1
491a2e2a3426ff51c486b7343d8d6b0b79e2b8a3
-
SHA256
bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a
-
SHA512
e9ee27e03aee4bc227716fa3cdf641a48bee2ccc81237aa1323a3411a75ecca712ac61ce4d2e0892be383c6a140e0c002ccf77125ccccf7ac9d4530eea54df37
-
SSDEEP
12288:/tCtvNv+h26xiWZu8xDPtgPuSYAuXIPY2wKg7oGviTVp7OC0aO:/tChNv+ceiWjDVgyAurCg7osJ1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\o1d\wermgr.exeC:\Users\Admin\AppData\Local\o1d\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\yM9Txc9\EhStorAuthn.exeC:\Users\Admin\AppData\Local\yM9Txc9\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\aUIiMYevK\mblctr.exeC:\Users\Admin\AppData\Local\aUIiMYevK\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\UWU\rekeywiz.exeC:\Users\Admin\AppData\Local\UWU\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5cb98c5b9358d14e4931289bedf9c4a68
SHA1a473810d335796a992e0d7e65c0450657508ebfa
SHA2566ef1355e425fcdc7339b6dfbb974e572094af56f6baf89845e176cdaa95cabff
SHA51272cade1fd236fa37354e6edb3d3e678bcd0551cd37aab1a2a1af76551bf8651f33696293121884ded3a3e5457f8f4a2a6cabb4c13d439934818866db06315813
-
Filesize
1.3MB
MD57ffc25da672e0941ad82d1b021a6ce20
SHA182665b3133c9687953be46411747c947d98bfb34
SHA25646d5f36c9c6ee52f5fdb2767cb8eded21c8e5128b87d4ebb52f197599e338972
SHA51220533366aff625df880c60eaba625dd8ed327a274ea75e5c36e4ac65ce8daca9e47974149dbac7894d6f1b4c16ec72bdb8e841aacab417536a4dc0fd642e174f
-
Filesize
1.3MB
MD592d029f01ae8172f2099b9aa411655fe
SHA10d3a4c588c4f5d0a748c9adf5b96abaee9c35e74
SHA256781456b167001699136726f22abaa0d7eb46d3937a58bd548811ca02f356a57a
SHA512ee8c45c3cfab5b3a887df2a98fe2052e15de7b0555913c8268b5d4370aa3372d6214b298ddf682a65f407cc250f51051a6983c81ebdadf78bb88572ec25687cd
-
Filesize
1KB
MD50f6f8a285088a0d58af6f26be8140fc3
SHA1469c631e4243148e0eb6c955a3a7c576761ce076
SHA256aefc3c0850420c17970213fda52bf3e8a8a13f5d016feb270a245af1fd0eb4a8
SHA51287801639bafa2b522154a3347cf54e513ad1258179dc7470f7f127f1824d364ead70a2ad090565920d3300ea09219d3011ffc501aab7beb3aa29cf4d14ffe8a2
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
49KB
MD541df7355a5a907e2c1d7804ec028965d
SHA1453263d230c6317eb4a2eb3aceeec1bbcf5e153d
SHA256207bfec939e7c017c4704ba76172ee2c954f485ba593bc1bc8c7666e78251861
SHA51259c9d69d3942543af4f387137226516adec1a4304bd5696c6c1d338f9e5f40d136450907351cce018563df1358e06a792005167f5c08c689df32d809c4cebdcf
-
Filesize
137KB
MD53abe95d92c80dc79707d8e168d79a994
SHA164b10c17f602d3f21c84954541e7092bc55bb5ab
SHA2562159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad
SHA51270fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB