Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:19
General
-
Target
772c9a9a5936ebf7ae74095e3bbc84543b533e0c07cfadc1f9359c3b95586e20.dll
-
Size
908KB
-
MD5
b0125ea2f2268bfbaf1303fbe6ed2b19
-
SHA1
046b69664e5e091563dbcf675197e076aca32e79
-
SHA256
772c9a9a5936ebf7ae74095e3bbc84543b533e0c07cfadc1f9359c3b95586e20
-
SHA512
b3550b5eb6f07cdb4ec5e81a2c64470bea8191dda4920007fd2bdfa7c6fec977c90b7d62247b9f5d488e8df64c1abfb98494f986e353c9e143cc26eed1476099
-
SSDEEP
12288:6qJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:6qGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\772c9a9a5936ebf7ae74095e3bbc84543b533e0c07cfadc1f9359c3b95586e20.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Users\Admin\AppData\Local\bsLNK\bdechangepin.exeC:\Users\Admin\AppData\Local\bsLNK\bdechangepin.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\TEMPt\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\TEMPt\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\UhiJ\ProximityUxHost.exeC:\Users\Admin\AppData\Local\UhiJ\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5326a1e774d226b95b45eb3b35180ace4
SHA14702cd176b24be89988c378386e5a8a89cd9d8df
SHA256057982fa0ed6b2096931124d3e53b876af91c0a458bbc0c74ef774d1e79e8049
SHA512e79fd7201bc32f389744cb5295808a22e7d6f59365fa926914a0abee2744f50b09fe6fb53180a02992b5d4b3e792924e59b93189887f35f9f073c08f03cfabb5
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
916KB
MD5ec81df4e425af9fc1c34daeb9ef53414
SHA17f2990d5327a825f05699813978747a4e8c3e9e7
SHA256c821c7e7a4293b7f166f30f3a3abfec58769dff8b9ab4c96c289cb5cbd80ea5c
SHA5124fc30b570ea77919a32da23a3ea89b40418f8929003a1c18a060309cfd78550d2e3486de7cdfd50132b08ebe4cbfe6b27547f47fe4bdc9b069328ad7eb84de42
-
Filesize
1.2MB
MD5e5cd1317d9e7268609bcdafedb0336c1
SHA13f33f091cecfb85540c0214c002f021a2d83c781
SHA2561f32376904293dccbcd7d85bb1b4da266bf28138e2c9e49ddc4a6aac0d9c5b6e
SHA51217724b3956c41fe9f4eb928eec693980eae879f45a08261c5858161837a9694bece6462cb2c7266c1fb730c707835dab893a22c66958b46d4664a5e2fb58d381
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
1KB
MD5644ecc38747589057ae5da4fd1c41899
SHA12acac564cd5cb8c89472461f8c5018dfc694659e
SHA256ba3abaf19f026c61b4e30db2cace4746c0a961e77850112e3caef74a65ac10d5
SHA5129009a6d87b20b8473dd4653b25c0d30744af00125b3fb9b83c050e860be122bd705145aac672f12b74573dcb15de6a4ccd5efe9dbda7b1d8966eca4c0f050050
-
Filesize
916KB
-
Filesize
916KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
64KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
4KB
-
Filesize
4KB