Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:19
General
-
Target
af901d0533a3adcfec12e7844859f70bd22dffc6e83c54fd48cf13cdabc77600.dll
-
Size
904KB
-
MD5
40d159e05ca3922e4c803ccf5614a085
-
SHA1
577e7196c8d2a022a49cc0381f9dea716c577be4
-
SHA256
af901d0533a3adcfec12e7844859f70bd22dffc6e83c54fd48cf13cdabc77600
-
SHA512
6be1af6877eea2b53ecfdd32596ba9b8465b3885537cb7847a9795b2f92effdf8fafeb654113bceca62c83045fe9c717a2543ee215543b517c85d420745fa67f
-
SSDEEP
12288:SqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:SqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af901d0533a3adcfec12e7844859f70bd22dffc6e83c54fd48cf13cdabc77600.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\CY0\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\CY0\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\qT0c\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\qT0c\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\CcqlJYJo\upfc.exeC:\Users\Admin\AppData\Local\CcqlJYJo\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
908KB
MD59c03028368db60c7c6dac611a32ece41
SHA15bfd41c3c88f4cbca40a56f4d93d0353d7ba0a69
SHA256cc68c94747e3cd2e1eba42f8c7db286cc429f07ae4c71365ca7481a5abe50f39
SHA512080cc7aa7e58e24ce473c1fc2987292bb5a3b03f15abc787823b8ed48a7c79e29bd7bb05ebcda2e0151b013c0b69251b1cad4b083fb98b49b1210c342dbb5334
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
908KB
MD5f6b33c6d0b8c7e7c3925ab4fd242df75
SHA14d2d1b1255fc882a9d2f954337f4bc92b878b62f
SHA256263d423b83105fb82b40d9c4b50a03a7168786975df038d031c9b6cdd03a899d
SHA512c6093b0765f08baa9b62c8f09083cbf5df92f3071ea288d2a870e708e89fe5312b8beda32ac3dbde2afe99e54c1ae00fae17b0817abf99904d597a653c6c0618
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
908KB
MD5761a7f36b2445080b14a8cbe35a66eed
SHA1b83a18f299f35204f125951ede7d45c64449538c
SHA25615f717c562aed931536ad595853a87505e1a21e351e77f8f945c91aa572510ef
SHA5120c951b834a203bdcbce85641e4bf77b863f4ec499b2ca8eef128cd0e0ec7e2138578b021f50b16791e3cdc316ee689536c8cbbeaa47cf4669aee916c6558e488
-
Filesize
82KB
MD56711765f323289f5008a6a2a04b6f264
SHA1d8116fdf73608b4b254ad83c74f2232584d24144
SHA256bd3a97327326e2245938ec6099f20059b446ff0fe1c10b9317d15d1a1dd5331e
SHA512438abd282d9d1c0e7e5db2ce027ff9522c3980278b32b2eae09c595884a8dcbfd5178bc5926b1d15f03174303382e13f5d5ecab9a5d8e31fc07ef39e66c012e8
-
Filesize
1KB
MD56ebe36862546966040cfea01e6f02243
SHA1cd49b76974d56688bde80bb70763ebee63516657
SHA25670b65f0f7186f5b413919743d68193fcce6841605d40bb5a40fd014703e8903f
SHA512161303044981a62b2c1ba55fc61e4a1cbf723140942081e82c477e5bd05550d0f8178617b8e64fd49fc824db5f867fdf742eda5ff8c3cca0964068340da74830
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
904KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
64KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
904KB
-
Filesize
904KB