Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 13:08
General
-
Target
bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a.dll
-
Size
1.3MB
-
MD5
c593d8b78e3dda17474751a9a73f433a
-
SHA1
491a2e2a3426ff51c486b7343d8d6b0b79e2b8a3
-
SHA256
bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a
-
SHA512
e9ee27e03aee4bc227716fa3cdf641a48bee2ccc81237aa1323a3411a75ecca712ac61ce4d2e0892be383c6a140e0c002ccf77125ccccf7ac9d4530eea54df37
-
SSDEEP
12288:/tCtvNv+h26xiWZu8xDPtgPuSYAuXIPY2wKg7oGviTVp7OC0aO:/tChNv+ceiWjDVgyAurCg7osJ1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 13 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 5 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc14ef4108eab623eb267b6dfebce5c1009837a6b126c567ff66922e5f4c8e5a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\Hvkzb4As\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\Hvkzb4As\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\bqgV\slui.exeC:\Users\Admin\AppData\Local\bqgV\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\hDCN\mmc.exeC:\Users\Admin\AppData\Local\hDCN\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\ovzl7js5p\MusNotificationUx.exeC:\Users\Admin\AppData\Local\ovzl7js5p\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5d919914976d46f9ee27ac6c8fa4c010f
SHA108df02813fa949c0b03f695395f47e2b69771244
SHA2561c0f52aaff8af58b93a838d16c6f0ac102b099b3cd43110598215e419c37754f
SHA512f9136ace7f14911268cbda46c5d6fdc9ea4e0fdc5ae3e68e5d175a3058638a4a798fbb2499f2dda9f4b052bfc37dc226d5aca34561c7740461a4bb7ab8f9dc9e
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
1.3MB
MD5d6be6dc66e61d5cfad6e66aad1ccd242
SHA172c80c50c9ec9ab84c60a5dfbae95261a9026800
SHA2566618c4f7025b22aa675ae74385054042bb8efc67a3b9184dd7d3289fb8c88c33
SHA512fccd5c3b02b14475af0f84456a358de7bdfad77efba3b7b5cb00452d4eca8a7eecdf7a032a3c66915d377e96c04eea6acda639ccebc065717e76b4d0c1f74d5b
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1.3MB
MD5bde2d1acdf63764b9a5537909f0ebda3
SHA1498d681f3856b6f3cc444a2890816d44dd8d5a7b
SHA2569f37938bf0c7e98320d10e3528e0d35e25200372d6a5256c5608aee198cc1c90
SHA512395475030e8c043957c1f46bc59d330deec8651c691d2e09f66594b5833a083ff801b5d7b88aa468980e18d85854d257b94c4d134835e1904cd46fbc7aefccf0
-
Filesize
1.8MB
MD58c86b80518406f14a4952d67185032d6
SHA19269f1fbcf65fefbc88a2e239519c21efe0f6ba5
SHA256895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a
SHA5121bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
1.3MB
MD5d1d5ad16b1b15a8a3acac2fcda14a2d0
SHA1ab8069dd8f201cf4aa6a49d054000d85a1a83f3c
SHA2566b1fac4a6b6496e7c5d4d1ae7fed0b8fd9d790514291e1b934cbc1f5fe342cbc
SHA5128558c5e27618741a07cfecdfb4aa0ec480f764bd34c75119ef2d58cc6e1748cc11b9c6fd70726d81f6cbb33ad698ee0b44eb45ad4f074678a1dbe19335dc2107
-
Filesize
1KB
MD5a2933c3eb5f97ff41c164fcea1d7eb38
SHA16e335d9630ba59c8161ac4ca2041b80d9f02dc8e
SHA25689d6968aafc4684eb10c2caaffc879f06deea00665b78bbe4795da9aea127b77
SHA512b8b17ee56039fee5d96cd3daab6f3e8549343e2b150c5f4361bf67bc357258ca009750e4f521e8984b6b86b9f148c07154e0664feb552e5b3049773368c9daa9
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB