Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:19
General
-
Target
9f9e5e220ffdbfad25a863d7e9f99f345eecee23e695b6525a79337eb839c590.dll
-
Size
904KB
-
MD5
54d31559f9dbc295e20cf99dee50ac94
-
SHA1
81986b520be480a568f9683d8b93d06433cbb53c
-
SHA256
9f9e5e220ffdbfad25a863d7e9f99f345eecee23e695b6525a79337eb839c590
-
SHA512
1792ab82fee29d482c5f229096a477cfdeeb1b670f21b9542d91ad4bb4048e976ef9f0c73195675b4925fc2f7e2b8b9d3fb0fd3b8ae4162ad7a0ff043043d440
-
SSDEEP
12288:+qJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:+qGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9f9e5e220ffdbfad25a863d7e9f99f345eecee23e695b6525a79337eb839c590.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4uinit.exeC:\Windows\system32\ie4uinit.exe1⤵
-
C:\Users\Admin\AppData\Local\UD02hrT\ie4uinit.exeC:\Users\Admin\AppData\Local\UD02hrT\ie4uinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\utdRJg\systemreset.exeC:\Users\Admin\AppData\Local\utdRJg\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\tSbAUWDq\DisplaySwitch.exeC:\Users\Admin\AppData\Local\tSbAUWDq\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908KB
MD538a74dce40d2ded5a38e976c93663da2
SHA1a82b5bb040ec4b5ee637f40234fea2092a222ebd
SHA2564f3768f28e63cafea85bd9e9be7cc41fc62d778199b3de65a15bd08a4c506a5f
SHA512e459913ac9ee2ffbf4466a8ca54eef77fd42d71812640431b0a18c2021e80398ed876911734fa9834f6864188d55b516b0c234cc21e5fc1d6f4beefecfcd0667
-
Filesize
262KB
MD5a2f0104edd80ca2c24c24356d5eacc4f
SHA18269b9fd9231f04ed47419bd565c69dc677fab56
SHA2565d85c4d62cc26996826b9d96a9153f7e05a2260342bd913b3730610a1809203c
SHA512e7bb87f9f6c82cb945b95f62695be98b3fa827a24fa8c4187fe836d4e7d3e7ae3b95101edd3c41d65f6cb684910f5954a67307d450072acd8d475212db094390
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
908KB
MD5d81ddf153a93068c93e6d4003e589e38
SHA167d1579bb5dadb687edc57b3643b954934bcf2fb
SHA2569088e56b320aebd2bb1b78b2354e8314063bcdd2e851f688ad183e76280534fd
SHA512d18e6a8cf19825b6681b673d407205cc4dddfffb85c4d7b49250b7ed57e45953f50196921fad72c4a98fadc81615bdb592ce21a29043e6f18ac1f72cb138681a
-
Filesize
1.2MB
MD5013ebe5755abf40a89b1cfb52e469cf7
SHA1959abda4926797b26d3df27838b9364ed0d72b01
SHA25637045b4f11dd910ba6f06dc4f6942e8fc88d3f1932f48c41427a09df2042fdf8
SHA512460a9dec62dd7e7f09b9481a62393d043912a1c7db327d4e3266eb22e93d47ced61c6314f87799e41c7c626d31a0ec72429c4fa7e15c67e4439fcdf65c3fd4e2
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
1KB
MD5f7eb06d5a587bb7298ef0dda58febb02
SHA1b7c23515c98a294063d87ff21adcf11dccf675ec
SHA2569a8bf4d1c2eccacbf7b32f4f649ab1d32b60a8567402bc4f5576db75ddca3420
SHA512f8a6039e4058dfac6dea4a03e804d67285fa8b7a661ddd66d5903e292d976f67a24c904bcc3d1e6fdc0aa1693e43da96e9004290a1cf0acc998c162150a93609
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
904KB
-
Filesize
64KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
908KB
-
Filesize
908KB