Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:26
General
-
Target
26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9.dll
-
Size
700KB
-
MD5
eaad0504af393af4c5f770f1f921df14
-
SHA1
dedc04982b2d2728d5d11eb4f99d870ad89e1381
-
SHA256
26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9
-
SHA512
27329a5f0f89fc395320c1f1e1f9177e8a296dbc7125119760bdec56fee37e177685759b5ae8bec632ae4876dbc725b89c7ec8ffa40f9f97a6ee7214e9154dd8
-
SSDEEP
12288:tqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:tqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\krM4n\PresentationSettings.exeC:\Users\Admin\AppData\Local\krM4n\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\qW5Y\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\qW5Y\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\rrrq\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\rrrq\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
219KB
MD5790799a168c41689849310f6c15f98fa
SHA1a5d213fc1c71a56de9441b2e35411d83770c01ec
SHA2566e59ab1a0b4ac177dc3397a54afcf68fcea3c1ee72c33bd08c89f04a6dac64b8
SHA5128153b79d4681f21ade7afe995841c386bff8e491ad347f8e7c287df5f9053cae7458e273339146d9a920ceaa2ba0f41cc793d7b2c0fa80efbb41477d39470866
-
Filesize
708KB
MD542da7f37589c11662d569a1a2de80a1b
SHA1c0d37411feb8fa7c28fb90be6a7f8e51c2c5baa6
SHA2568985be25e180c812f01edbd1c99c40101f754d725f9e865fca88b5e126de6e69
SHA512e206b67ec3f8057e27bc37c1dc97aa10890bcb845542f907e74825aed5a48cb29de00f86b92dcaf21403d89c9812e41b28e79f78eb22345cc32fe9ca8c625956
-
Filesize
980KB
MD5fefcefe1d3a7c852f5ec607e111b7d98
SHA12eb1c57456640f648b789174bec224c56738f260
SHA256e1f5634742fb8246c0c72ec0513e2b4d970b4783cc561ccb99c6e77b9f8b6436
SHA5120577fe41e1ad2658ee333ac8781eb2cb9b43bcf7d5364e58d39aab394c43270878d44cca9e15288d27ae70cdbba409272f450d522dc0773f55b1b5ba5aebb3ae
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
704KB
MD5f6b157a6691081569156baf04d4fe0f3
SHA12570a5d0f9daa442fbf9d7a501d3679577c94ad2
SHA256a6d9e9f7e66667bf99e9360fe6b2083bda1a203b12470f24b5e005ded6712409
SHA512b39b3658693d7fcefd95112779dd1aab9913fdc0e3f5d78bca22681fb823ed424f92971ea17e09499730f9530f2df988d5987fbe18f3d2bb5f68dcfac11acba8
-
Filesize
1KB
MD58ce87bcd86644b1736ff8a9e62bef89b
SHA172c1730da5a04808918dcd989f3bc77480d58874
SHA256a4b8423ff7541417310a6549788ae59f393b71888cabe9aa60ea8d50be252571
SHA5126b13505ccb566bf6dec17a748db8116d66db19c5bd911a66566d517cf07cc782dc3b27610cd08ca9a6955bc0aa5c1651a459548a4fecf978b2513844f7ba7136
-
Filesize
980KB
-
Filesize
28KB
-
Filesize
980KB
-
Filesize
708KB
-
Filesize
708KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB