Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-10-2024 19:29
General
-
Target
6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf.dll
-
Size
728KB
-
MD5
3a325295832f70c883b27b87efa606c6
-
SHA1
920e9216016a61f1323024604facdb3fa3d4739a
-
SHA256
6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf
-
SHA512
8908496ecd06be35afaf723601ec8478f8b6d1805bf390f5fbb2301db21d0872b0b63f4dbdfb1f9d03db8ecd721a697a49a6eb79d6d5d3e2f173e3176cc7c05f
-
SSDEEP
12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\zxRgsmsyE\wextract.exeC:\Users\Admin\AppData\Local\zxRgsmsyE\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\BwMtsJ\dpapimig.exeC:\Users\Admin\AppData\Local\BwMtsJ\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\xTXn\psr.exeC:\Users\Admin\AppData\Local\xTXn\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1008KB
MD5f4a1636532d9cd7db0e830d47c861654
SHA1e48d6ac266b122321c5f982f4d0a6cad879039a8
SHA256da101aa3ada1476245a7231bfe44d910c6db9c8daeaadfbc8597af6ada1addf4
SHA5127beead75ef7ad2f895be2e4c0f2868a54a2271b60d1a6c9386a054a82830f61ddb83d9cdbf9d4900ecff34138b521733d79cc5d4924f05cf1a01589dfaba6f3b
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
732KB
MD5b8e541e9e0d06e157f792e968ce2f446
SHA1b33e7f7385cc346d562964ccd1c358b642b38a96
SHA256e15b0f3ddc19de240276761c106290bc68a3cba81552f66b810d9307303a05d0
SHA51241450429952d4f4c0cded12f78cfe7ebd084831548d37727b17fe52075f4e07165a0d73bfacdc5d2b16afa0205d3382f46f51f87a3669910723a035dc3bad9c5
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
732KB
MD53652db64e3322c3298339e33f7955ef2
SHA19f4392c154e01381c3d56fd5489035050d2cd555
SHA2568a77e815338482a9ea79ecc258ac3e6ce915a651fd5d07701d7f7fb784dc44f6
SHA5126255c46e6b9117d02082055eb5564258cb1fc14f2c8fa528a6dbf1b4eb9cfae9b9d8e18336bdb914e129f4792a39a9da24256a340798ffca5cecf151116c6009
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
1KB
MD5e418e1aec7a16d6b4c5d51ea6ff10ec0
SHA15a25a02aab5446e5369afcf9bdf3dc9dc69eccc4
SHA256411a7cc15d89fbb8449999d398f96c2ae0f7cc3cd2a94f581192f19e7bd58ade
SHA512de366791c1f50c1a21d936a01d9143575ca35deca46a1d9bd8b18649fcf54da8ec742a67dab0049aae3ee0fc05f5d31673a14dea484d51cdd7327b00c1ce7313
-
Filesize
1008KB
-
Filesize
1008KB
-
Filesize
28KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
28KB
-
Filesize
732KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
4KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB