Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-10-2024 19:22
General
-
Target
82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b.dll
-
Size
720KB
-
MD5
063b08ece19964bb44c048bdaf338d0c
-
SHA1
629c98179cd6f9dd0d642305ba7ce56525833c6c
-
SHA256
82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b
-
SHA512
c9374043f8b06799b2fc49c88c5b26e838dbd9ac28f87fa4293cbd1775b67d1ded3eacd62c02c4230c694114f65b078dfa6fb196510e0106c9e32a96bd1484f7
-
SSDEEP
12288:HqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4BaedXlS:HqGBHTxvt+g2gYedXlS
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\QbPgOqh\ComputerDefaults.exeC:\Users\Admin\AppData\Local\QbPgOqh\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\SwK\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\SwK\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\A7lnnf6\Utilman.exeC:\Users\Admin\AppData\Local\A7lnnf6\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
928KB
MD51408c8666a9479ade86aec39cc62ce49
SHA143e49252cb40ab18f8363999f3654a5e81017c83
SHA256e8691ca69d8db9863718d4a01e75d8029dae3e3b371f47670d7a81ea49640fcf
SHA512569c0f99b74de26f4fdb5bb60668beedffca483010c8d173b146b7d5a2f0c49a3ef7d7178c55bdda96fb7fb63b164357e557d3386ac5e3e38f6d2c57c95b8e8a
-
Filesize
724KB
MD518e6b5552af22be6542c4ded55202b2a
SHA164f3be46f5bbfc207e1a2ed7e010d7ddb78d969e
SHA256754575b0069b7339a6e340e68118924ef4b45a28ac184ff63315bb8ee3ee1366
SHA5120eff669e141a88a16c10d746eebb24bd6e63557fb11c381f0452d620983e49bc40cdc9e6ab05a3a657d0fb6e10cb84b0c22e931bb24cad7d0c8a0626989c522f
-
Filesize
748KB
MD5ad959a271446390a055abffd9fbd9ebc
SHA1c1472980eff30242b5f1c65e417eec7f202f2167
SHA2567874bec8238b965ea0a48aec5deb7379b8309a156d304f794443ba93b891c543
SHA512a882ca2129c9f0cd820567b4b8a48a8888e39764165c78006fde6858046b041b624d5a5a244200999df879d3468ae5a0449931aac3e6c6d65eb45ef828342880
-
Filesize
1KB
MD584bf8084be76a5e22159e9bc34e80665
SHA1e5073de56cbbf249dfb345f294189b47ecaf8d26
SHA256b76609ec53e0abf51dbeeca9566dfa4116c4851076b6b6a3adc3e148bd028798
SHA5124e42a751f66859c3024b622fc3a6120e72c2e89196cbcdd6225c50d263e2699b86d124281e765e20a232d2ae7eb97e542f8357920f885de3af182974ea70d227
-
Filesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
928KB
-
Filesize
928KB
-
Filesize
748KB
-
Filesize
28KB
-
Filesize
748KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB