Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 19:22
General
-
Target
82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b.dll
-
Size
720KB
-
MD5
063b08ece19964bb44c048bdaf338d0c
-
SHA1
629c98179cd6f9dd0d642305ba7ce56525833c6c
-
SHA256
82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b
-
SHA512
c9374043f8b06799b2fc49c88c5b26e838dbd9ac28f87fa4293cbd1775b67d1ded3eacd62c02c4230c694114f65b078dfa6fb196510e0106c9e32a96bd1484f7
-
SSDEEP
12288:HqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4BaedXlS:HqGBHTxvt+g2gYedXlS
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\82bbb37f2ea3e1afd819a87eba997c908ba7b061bdb28880e11bf490f6b6c48b.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\zXv7E\consent.exeC:\Users\Admin\AppData\Local\zXv7E\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\9frz\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\9frz\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\MY19L\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\MY19L\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\jrzU\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\jrzU\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1000KB
MD582083e9b551cff4a623abef34578e1f4
SHA18da7158c3376307a362c7c607a877986d3e53f87
SHA2563eac02bbd4fb391f100c6667ee1461aa560ec739d34717b1b6e582d853d67bad
SHA5121bfdd4345ed6377a42a331176a1b7e85cacfa121f8c73783815a8379102fda30106a3f748cade08b71e3287a6407fde00609bc94bb60ba193a398d7c301154ac
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
1000KB
MD5ac83e27df6f34a16db1ee84e8625f544
SHA1a999764fc190cfba83d36e4dff5cc87816c8e375
SHA256876b58890c2ceb4aad14fc6e363b388bd1fa2f3c9cce3fb3ce1f2f9d26c73893
SHA512d407574e6e00d59c4346a8fa5811d22534cdbb34592c4ef53e4f0772bc08725be64d4faf014fcf0ec3a1cb03e9533e51c8b06532dc7c1d960eb33609c75701c9
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
724KB
MD58d6c7f2b8c4e105e473b2a37ec864610
SHA13d8f1c3fd0df75f4fa4caa50a09c7cce2e4d9d63
SHA256547aa4e3fe1a342daadefc8d05239bd43d4e0b6db4237eda1a699fad7588d753
SHA5120f3e35c9c3f14ffae4fa03f12d44839bf976d21161c949f813e7c98a1cab9f1682b62591cdf58e559a4f26fd3d566a909d03460b4d0f4ae4ce8b986dc3a7cd46
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
162KB
MD56646631ce4ad7128762352da81f3b030
SHA11095bd4b63360fc2968d75622aa745e5523428ab
SHA25656b2d516376328129132b815e22379ae8e7176825f059c9374a33cc844482e64
SHA5121c00ed5d8568f6ebd119524b61573cfe71ca828bd8fbdd150158ec8b5db65fa066908d120d201fce6222707bcb78e0c1151b82fdc1dccf3ada867cb810feb6da
-
Filesize
1KB
MD5a33e2f8917716ee13d2b6ff2149f4726
SHA1039075f6bac959f5563b81bf08f028d03672ed74
SHA2566f277c29d4799f7d6e06ce0e0c28d6a113600c0888f7bf1d7799eea59e9ce879
SHA51287976c87bb9ff253ef2138f92ec0c80f369c54eb951ae4637fd96a94d00bd404cd23b2640951ba899db716e078aa1e4179ff2f79fe67abc8d8e27a56230886f2
-
Filesize
1000KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
28KB