Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-10-2024 19:22
General
-
Target
6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176.dll
-
Size
724KB
-
MD5
6a6345e39d25621d971721a635aa86e5
-
SHA1
36c3b301d60b34ebe4b206e1660d496f991a9a1d
-
SHA256
6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176
-
SHA512
1b7cfcb8d052928407cc38126c7001140ed77f07c2162ef79128fef40bc3aea42b38ede6412b9c60e361a6a29cabdcc43d38cdbd83b5191d63d0296f3dde22ee
-
SSDEEP
12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6dbd1df5459b17bb2c9fdb7849e4294657404971ac6495660b29464e4a69e176.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\MSkEz\rdpinit.exeC:\Users\Admin\AppData\Local\MSkEz\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\XZinBh3\msdt.exeC:\Users\Admin\AppData\Local\XZinBh3\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\qLJNw7u3F\msinfo32.exeC:\Users\Admin\AppData\Local\qLJNw7u3F\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
752KB
MD556738cbfad0a93313507360c216b353a
SHA1c281ad4c5b17f877dc8cc81981158cd576914261
SHA2562799c8cdeff985787e64bee1fbb1d9feb2ab18df2a30ad7c625627a9e8482ff4
SHA5129c29877de01c627cc9caebbe4dc0520df3f1a68a7f55f4bf48e5057ff00d6972d4e65e0d8a7e76c2a39da5b89e60cf14f6b61bef88e95bdc3d3c2d4490358dfa
-
Filesize
1012B
MD5801abbc974231e02504be7ecae1140b8
SHA151399a9716fc057cb678e417e4a3114782826bbe
SHA256959885c9eebd93ced8aa67d647b1f83cc9172d37b8f6cb270103d3f72281c39b
SHA51260237b4f92743f6fd767043456ba9b5a613bc9d98516c2f5b04d93cb94c162c266d3b8dd1bf5ef875648d660e584e5e6e592f398ea992697b361a66632334071
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
728KB
MD58698ac6f1fd71badb074a93662c249cf
SHA1ddebe7c9eeaa034d8247bec2ab5fa6ff92f94709
SHA256b04f3e416766962ebeff722539ba388db8adcbf4cfb8180d10573d205547e3e4
SHA51275c0e5db71f40a2570e24c48b783d13bc2cd1e9fb511c295aeb73f994c3059facd01acf2c3f8f266c611a076127877ba3636485bfe1cfa1d41b2d9b40963c36f
-
Filesize
728KB
MD5a42975276538e05d7e2ec89c002c074c
SHA1d8ebaf527e4788428d531710ad10fa329f195ed7
SHA256448b3dc1ecd26f7ec9c0b3619c1a49565fd1fa722be14fea1719fd3f1308f1e3
SHA51210b33618b0b9f6fe2d3caf8edbcc795bfca88cdf870ea569482fdac875048715b58fb144a301ced30207850c19ad5ba667a1b8b93da99db9b7a49a42178877e8
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
8KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
8KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
728KB