Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:19
General
-
Target
8942de37f64cd1f04b7022ad6d9713df408d9e9449e3942161ccebb970fdc109.dll
-
Size
1.2MB
-
MD5
b8839ffc79f088860701573eae079ec2
-
SHA1
88323714954aec18328ded2cb0a7ea08d5f5714d
-
SHA256
8942de37f64cd1f04b7022ad6d9713df408d9e9449e3942161ccebb970fdc109
-
SHA512
4b6d7a362f6f52721a026ce293d9d0b647cea983bc52a896022cf605b6abe127a5532cba24bc07f579ea6e6b0bc542e1b62d93a746015cf606b69c50e5f5ad41
-
SSDEEP
12288:KqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed0j:KqGBHTxvt+g2gYed0
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8942de37f64cd1f04b7022ad6d9713df408d9e9449e3942161ccebb970fdc109.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\vBsIMcH3\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\vBsIMcH3\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\uwVyx\sethc.exeC:\Users\Admin\AppData\Local\uwVyx\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsAdminFlows.exeC:\Windows\system32\SystemSettingsAdminFlows.exe1⤵
-
C:\Users\Admin\AppData\Local\ORqN\SystemSettingsAdminFlows.exeC:\Users\Admin\AppData\Local\ORqN\SystemSettingsAdminFlows.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD514a75a3f380cb3dcf2a09c81df05c150
SHA1416e06d2ea8fe1695f7c340a034187a60d2b2707
SHA25685944a7a132d3f14a18159d5689c13c233c68171ae7a6d097bdabc0c84225db8
SHA5121b5b5adafb79a90ab752dad1f742faaa4e52cb27192499ec31730aa74250930961ba0b9e9cfdd3d84981306de4609e94649e2daf8fc9e382a9e5d0e250f01e4e
-
Filesize
506KB
MD550adb2c7c145c729b9de8b7cf967dd24
SHA1a31757f08da6f95156777c1132b6d5f1db3d8f30
SHA256a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec
SHA512715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0
-
Filesize
1.2MB
MD5b4836a205b2db6f9aa88c088bd44d1e7
SHA104e9fe3bc8c87defebccd5890042469fb58c12de
SHA2566be3aa836080852d3d64feec5822c96194d83a09f4849dc13b644ffa5946694e
SHA512564df9cc3d0da91e65063e773b354d440845485326530da792017076eb3a625466c1effd55a5b38584e57aeb730fc9fe93ff70034669b74167e8277fce3e4461
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1.4MB
MD5c25f4dd933b6eb5448d8ca4d3616b9a7
SHA168aec4201c717145d18cfab8322f849c44adae06
SHA256bc05b9e8bdf5f3cfc49d6334fc2e5b9e975b4bceca40ec378a8cc6eed8384fac
SHA51299a217caf4944ea4eab04ed185c04247fbf33e371ad0ab13a8e224b9c0bf0a136c3fca26658bced0fd208d354645d3dc42875037af4f373edec579609577df32
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1KB
MD504b71dfa9d462b9cf2dd00704ebdf488
SHA1f0206f8d189554bf985b0d498dc84cf3b52ee65a
SHA2567cee2b3e49ff5c9e0f4b1242c5685a84ddf76683121d0e0206ff137e7e0314aa
SHA512dac26acb81b177da63e214a11f4f5f1d660ae05c0bd26aa405e9a3da10820a2657015e2d230c681eb2d4552893902fc51547942b461e213304de0a26079ece8d
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB