Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 19:22
General
-
Target
dfff1351a71e2a46724a191232467ee5aae1ab441b331253293ff682272c2a88.dll
-
Size
724KB
-
MD5
2ef91939a663dcb029490b73596d0c8c
-
SHA1
cefb7533cbab4ad4d1bf351bb78ef0e3ca95729d
-
SHA256
dfff1351a71e2a46724a191232467ee5aae1ab441b331253293ff682272c2a88
-
SHA512
c6fb10150a279d5098ca52a15edfa05bf39301312345d01aeefff2812a2515f97eb9f2e461857eaa420f3c135457b34a2b931ecf9b0119f1301716fb383aec5a
-
SSDEEP
12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dfff1351a71e2a46724a191232467ee5aae1ab441b331253293ff682272c2a88.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\j6A9nCj\lpksetup.exeC:\Users\Admin\AppData\Local\j6A9nCj\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\KngMgJJVJ\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\KngMgJJVJ\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Narrator.exeC:\Windows\system32\Narrator.exe1⤵
-
C:\Users\Admin\AppData\Local\wqHYd\Narrator.exeC:\Users\Admin\AppData\Local\wqHYd\Narrator.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\NTg6pXVj\OptionalFeatures.exeC:\Users\Admin\AppData\Local\NTg6pXVj\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
728KB
MD519b77194ac11187c7ebfc4d19c0f5c73
SHA1408e76daae542f85fed503cd5196b2d6b59934cd
SHA256fba927d8aa77a08dfc9b7c0cc6c43d306c4c2d357d0be7028a76b1c6f9b32685
SHA512a5da3ddc041581fad1bd7b32e1bbe070a0e9098d44a93ef4f63f6333f68389d1c16a72c59cb59eb96f8c4952466ce8dd24b624c0676d19ca65512c6688cc9f63
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
728KB
MD58f11876459687d2f2c6d53d9649d812c
SHA17aab3c7cb2c636d22e30ab52535481f8f1e221a9
SHA25662dfe498d6399f9c1caa10ea9d680f2193c76e7eff4ec06fb1209f9352d7d0d3
SHA512fc48164202376bcee88a27fe102dac78e72c42d855f432c4bf03aab2bc193f1f4103686b99c81d1cc57c0022dc392139399cfd49fed6b6d4420624e35bf8269b
-
Filesize
728KB
MD572672fa945301e942dd7c03276e9faf1
SHA18eae5cf4a56d1b846f9367caa12467e80175285e
SHA256539627f25e218e5badd7ba948112bcd49fc67f1541cfb2af0439f46025227e52
SHA512cfa9005b2bfac252567b6198bed5dde3d8b46d4640a643058502dfa505317ca4f2437db693c204792f7ce59e5326e94ac141f7af4c933869ceb44238ca3b3da8
-
Filesize
728KB
MD5c75516a32e0aea02a184074d55d1a997
SHA1f9396946c078f8b0f28e3a6e21a97eeece31d13f
SHA256cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22
SHA51292994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc
-
Filesize
521KB
MD5d92defaa4d346278480d2780325d8d18
SHA16494d55b2e5064ffe8add579edfcd13c3e69fffe
SHA25669b8c93d9b262b36e2bdc223cc0d6e312cc471b49d7cc36befbba1f863a05d83
SHA512b82c0fbc07361e4ad6e4ab171e55e1e41e9312ba995dce90696ca90f734f5d1ea11371ca046e8680ea566a1c2e0643ab86f1f6dcf6cbd05aed8448425a2830b5
-
Filesize
1KB
MD5404e236d503f9bdc91c0e660dc587324
SHA16d042af0a4d7a2b13f08ceb7fe726e4c60a25a8a
SHA256755b2e99ea761b73f7d6b40e52f7a2cd05a715ca7f5ad1de233f0b49bc451abe
SHA51262a2e8c1a006a1e8848e93acafa9aaad8ebe8530aa2ebbb19b501a89374ee45a44c3435fd2dcbf7cada6bb008ad65d1730626beb8545f4e2817fecfed153b0dd
-
Filesize
724KB
-
Filesize
3.3MB
-
Filesize
3.3MB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB