Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:26
General
-
Target
5610f2cff2a5352f2aea2e2d85f83d8dd8d44bc56b776a938ef4826f621adcc7.dll
-
Size
700KB
-
MD5
f361ea6f535b8b1dfbfe86aea88cc345
-
SHA1
43d2f136fbf4fe3918efcc246de89783158bd17b
-
SHA256
5610f2cff2a5352f2aea2e2d85f83d8dd8d44bc56b776a938ef4826f621adcc7
-
SHA512
476b50c70ef7d07a5cb77413824783bc3ae00c1df5e8bb0cd4d6482eec8087121fbaa3fe1a4f47f20422d655699493baaef14ee9b93bd091c0ac625481d0ae59
-
SSDEEP
12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5610f2cff2a5352f2aea2e2d85f83d8dd8d44bc56b776a938ef4826f621adcc7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\L8fY\msra.exeC:\Users\Admin\AppData\Local\L8fY\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\IPj\msconfig.exeC:\Users\Admin\AppData\Local\IPj\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\vEd\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\vEd\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD594300b115dcf0d9933e6b46361689a5e
SHA127989b2d1a03355fce4c4c5c5555fa0e0ad92f69
SHA256bc1f447bd89595714b1e8c6a9c4b4f8d6dd4db3b24d7db33d3e7da853605615c
SHA512a4907062e7de4fc499eb22f68474fcf3ed178f470d360dad2cd4b78b3e90e683065eb1be6d1a03bd8f74e72184d4688c18e09c621aae1da1af8b3bb58ef4f613
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
704KB
MD55e23247d58064592b4b774eda5a7decf
SHA1ae9a85e1f357af5472684ede470df3876a1d47c2
SHA2564b6c6d444e3a8e08c1d19a58303ade4209632dd618f912bf53347ecd65d1cfb0
SHA512ea2a5cc24439908b40957f7f450a8fa2ebd362587606be09b7cfcb73d0ceeeff1a713cf999b3fb7eaecd4e80c7107b43c4bae9e33d57937df99ac3209cc251e5
-
Filesize
579KB
MD5dcda3b7b8eb0bfbccb54b4d6a6844ad6
SHA1316a2925e451f739f45e31bc233a95f91bf775fa
SHA256011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae
SHA51218e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5
-
Filesize
704KB
MD54b9fcc5cf7fab5de80d204ee1c9b0760
SHA1ffe48fa7cf9bef03d5dea46a1aa163610ab195d0
SHA256d4bd0042ea602f27bf3a73aa0b5dc1dcbaf48560dd5cde385633e724b57650d9
SHA51248fcd7294fc6066870aa04eb4fd2d0fd09bdc3290a09df4496782b1e19fa70c55f2059264c4d013fedc55c429dadab65bda96972adb6f5afdba68b831c52c541
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1KB
MD59d3bb82393f4da363f368a8b31c8e10a
SHA1e880cedd0d439a6204184dd9f4fa78c42f7b4bb1
SHA25618e6c5c739cf381080048befa0e19d29dd38ab8a33f71d6cf27ebade393aba1b
SHA5125ceca0b27b410f10f3b0e4a29ff30667fd6cdac44acd2df67dcec33dbf86c86e328043ac28eb9246370e7aaad5b6adc38da5a445ff9d1f307774ca9f40f5ac4f
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB