Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:23
General
-
Target
4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll
-
Size
700KB
-
MD5
6bd456cfeba026cd573f86e5531ea384
-
SHA1
66a88b459322450c073b8c4626f9967e951775c5
-
SHA256
4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb
-
SHA512
a35d4de20a6d51f668e08509255b7ba6ae8085170118c23f65202eb22d7687ae1474a29227f57410e146ca3ab27397d86329acfb08c48806308665f561943f3a
-
SSDEEP
12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\bFYxAn\msra.exeC:\Users\Admin\AppData\Local\bFYxAn\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\sYwMS46d\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\sYwMS46d\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\to9n8\iexpress.exeC:\Users\Admin\AppData\Local\to9n8\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD518d2ce6cea4d4972f03f41446dc3766f
SHA1a6aeeb512fd1588374c79c2328f0c987d136f4f1
SHA256d5be25a0e3a3caeb685b65c0da2cc4f6caa1095dab827eb7d8ecdf08f5996ae8
SHA5120f4283fa63065784b1344847ce05d42df43e17906734e4818fb5d697f099f2512214e864ef5964dedbd4cfc8aff3d8b2babd5827c426ed4341dbf43f19f1d4a4
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
980KB
MD56bb08d42b926761747fd12e2dcccef81
SHA15d0fffdb1796b65153850ca62e1901e06c14fb76
SHA256562acd3eca3200388a2abbce42ed4f4bd5b3a739d95e1cf245ca36a3b642cca3
SHA512a1994259aa18e9d5eb1ea6f3c3c31d25f87694989c96f92341efe5356eabf693df634676066df5e0acbb0e645d30e1bd510647c02fd85ee83327eb41886c7778
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
704KB
MD572a7f903570523efcc5b0799b09feb6f
SHA1d7802821904fdfbde080608b5c314d8aefd8fba6
SHA2562b30511c6cd46d11499760de7916ae977264755f3f0e1c0fa09e75bd2879d3d4
SHA51282660acd7c0d748e53b7d7cc757b92772f46a94e3a3d4d31232fedc45e3b4ba0f46a8a37573e16988a5a70c1e9796d59b1732255ef0fe9cdb290320a73ef4ac5
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
1KB
MD5d58c80de0caa2c9647148b338620a2b1
SHA17a31e722feb1a5cd35bf029ae5f1e19fb7a306f8
SHA256371359a2924317e605c3d34ecbabf0ee22997f2b174130c0fce78f75b713b21c
SHA512548e307307fa0455019b1116cb2a18dcfd0586609d3fea39eaad8e54fb1b2127134cabd3088ab2e2c00a72e93466b3b6696b991c2954f41e9c0583f109fa5c92
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
704KB
-
Filesize
192KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
28KB