Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:19
General
-
Target
642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9.dll
-
Size
900KB
-
MD5
42b74b886c2d75ff9bf4636e558d7ee2
-
SHA1
096a9d095b93fd378afdc04e04f0d82d23320b3d
-
SHA256
642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9
-
SHA512
688ad13892a5e66726574759fd21579887e2452b54397682a81643735ef050dd4fc4a8d152183802ad7f15f80eb2cdf889aa67a1b9050dcfd813cad00b363c78
-
SSDEEP
12288:CqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed1aaw6:CqGBHTxvt+g2gYed1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\A3xp0ohH7\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\A3xp0ohH7\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\vKkZsYTCe\RdpSa.exeC:\Users\Admin\AppData\Local\vKkZsYTCe\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\j23jfwqKq\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\j23jfwqKq\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904KB
MD58fd8a98cc1cd9842dc860e5274316cb3
SHA143fa69e7956adae0f6df5fe786cd1f9db3a27b56
SHA2566ea5132a4e730b11eefcf09f02b9d866beb05313b680e506a2592e882d736ff5
SHA51241800120564e0e44b37ceb36e51c74260cd44cfbed12c1e69c62cd1f6ff0158770834a972dc65a1d775cb306ad90515da741955e65a9f0c507696874eb9fafcb
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
904KB
MD5f56456f3442961e1bd2d6d8409e91b66
SHA131b22fea346a6541114f716465d916b155523da5
SHA256e2911c6f45a18c6e59e870d82463e5ff168265a315c64fd51a04543752033d81
SHA5128d017fa7739ce59dd8eac77869066c599cb277c0ec32243dcd92ef77e7b5ebc80db42b4d0fcddd1cde4ddd3aa2e7b2c7f14043be11354033198139affd5a22d7
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
908KB
MD554f9e684743cba1436cf1afb50ce1037
SHA1122120248fce6de9fcbbc24d6e985702aa70c41a
SHA256a3f68dd651513457c66962932cc26ddd0e0b0d258c9ba4fb3c8b07c583d599ab
SHA512bb518ea6fbbb33f51acf48ef8bc4278e3e310b6cab72a125cf38391bc95b7ddf3eb1ff7d14a87c18768d7b1df02560dd966f611a8c82dead75a9b626883006e7
-
Filesize
1KB
MD560793ee039709a8cee36bdcd5733f8de
SHA19be7ea6d2940fb63017c34ade9b4758c061d3a6b
SHA256cd80c76a24b0f66cc86687aa948df7af5d47c126d4148294487fe3608534cdda
SHA512bc0870290433baef37cde6c23a8bfad02c75df0fcb91a36d6124b7ed3cf0ecfa7b1b58136ea877d6dc907a2a8985907f923d3c260f4fec075cc7184aee7f020c
-
Filesize
900KB
-
Filesize
28KB
-
Filesize
900KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
4KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
904KB
-
Filesize
28KB
-
Filesize
908KB
-
Filesize
908KB
-
Filesize
28KB
-
Filesize
900KB
-
Filesize
900KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
28KB