Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 17:26
General
-
Target
5c75ed616297014a3a602a2dd07ed166a38118dd5288db2998b6ed9d4af46971.dll
-
Size
696KB
-
MD5
9ddd4fc0449313c0f8928c861e82d59a
-
SHA1
6ac9b2389831ccb8ee2225ab00b4e7a57c60f144
-
SHA256
5c75ed616297014a3a602a2dd07ed166a38118dd5288db2998b6ed9d4af46971
-
SHA512
84be854fad826486d5d39f445b603059d48ecc22be0692607c7747fa45c6ccfa9775854b069ddc72df52241aaec23c8254c63f408f26ada2d3c3fb030bcbc558
-
SSDEEP
12288:+qJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baedi1:+qGBHTxvt+g2gYedi1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5c75ed616297014a3a602a2dd07ed166a38118dd5288db2998b6ed9d4af46971.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\BSZAfTv4u\LicensingUI.exeC:\Users\Admin\AppData\Local\BSZAfTv4u\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\zRc8\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\zRc8\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\vzpJC\rdpinput.exeC:\Users\Admin\AppData\Local\vzpJC\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
976KB
MD5cbf2c790b3ea5cd078ea2b147ff76101
SHA153cca03e4b28213cc2c0fba399e1343e827bae10
SHA2565d7420cf1560f1849570415156a9c2515b9b92d7ccfb6caf27e9f0cb3df763d4
SHA51249cf6e72a33c271869be689a8424e37e41793f15a060e04e1a6a560f00a0aeba6c8803a8be21939853b7642e68e0bf67fa6db8edc638cff7d3d994c92b5ca2ca
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
700KB
MD50ad28fe23894c533a2e310307dc47243
SHA1a45d16bf337ef3d109ac40db9dcd33ec62412f66
SHA256b6d7467236f42bdcaddee68b9da6fef40dfb814365ef8d5fa02c8403f53aec35
SHA5121a9d0aad5734de75204bcfd2fc1caf4bec1e8c36d0c569733ff37452f3fbfddfcc615392499d75f85723ea8f801e76fb4218d6807bda081b9601bec213820c3b
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
700KB
MD54f1868498d74f22b19bf335fdd6086f4
SHA1bb83ca03c9483d3af841e2bde814a2404c3e1590
SHA256fe93ac77883683c5902a29695c0626d7e91316df02cc25cce1efbb277b37902b
SHA51290ae5a7c107699a3a521011a7ca2e550852ef31d35d565c2125141465d2ab95ffa2af827f434a34ae48509a3b82c58d9a520f36f2a3481e5fa391a97005bd29f
-
Filesize
1KB
MD54142db5b8979c8ae21f04c3845dad58f
SHA162bc45bb9c0a67e1bddd041df80cc77bcc8cb685
SHA2565d8598d6e605983de599d30cd81eb87d9b4a9f10fc497a33624c033386c3ccc5
SHA5127eefc0a300acc0cc96f1461b350e58bd873814961c51a8ff97cb01fa43998c7083c7e2738cc79c89a32f09ff8fc6d9e6c183ab839f8ff218b22d8332e7c125d2
-
Filesize
700KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
28KB