Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-10-2024 00:29
General
-
Target
c96f6800e719594a0985a65c2b5b86590c7470a36872f13804d5dbbcf4df32f9.dll
-
Size
696KB
-
MD5
631038be4bd53f745415c744e811f016
-
SHA1
bf6039ad50e15305c2983d6ee8ff6cf1cfeb8fec
-
SHA256
c96f6800e719594a0985a65c2b5b86590c7470a36872f13804d5dbbcf4df32f9
-
SHA512
5abcc343583f350ebff83996ffaea1faca0491f5a85e2a1b739263100899bb88ef5969dc180c4d7d91c248f0f20a45b7b9b6187462ea98d70284cb4dd6a88385
-
SSDEEP
12288:eqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:eqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c96f6800e719594a0985a65c2b5b86590c7470a36872f13804d5dbbcf4df32f9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\Zc1TP0TH\dialer.exeC:\Users\Admin\AppData\Local\Zc1TP0TH\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\V0Zz6YU\isoburn.exeC:\Users\Admin\AppData\Local\V0Zz6YU\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\G62J\AgentService.exeC:\Users\Admin\AppData\Local\G62J\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
700KB
MD507426700d625063140e6072721592651
SHA142d59043536b5c075c357e12a00fe8bd72769ee3
SHA2562381605c2f6c54a0a72fb7d8b882386c242eebdc0d9810a05d1832201a207a5a
SHA512b4a61b77afbdf887e6566560dc31b395888e2ec8d11405a907135bd6f819dfb8ffad064cd1af0966d9863749a4379f7a6abbfdcea4ba21235a47e7cab8d4fa9f
-
Filesize
700KB
MD53e10cfaeeaabed8e245df6c51031ec43
SHA1aa66cc51d51a401632f3ead4c0248f3078ac5b8f
SHA256568f34092dec33eb5fcf5364950d26cc0f19c0556d51779b1cbedd5762767d74
SHA512f6db8e0ae6da656fd3cecb5de75c825783550a54601c2e12c17153967a887ae8d0ef8ec52fe3d3cbd66a93d19d0aa8b31ca4fdb6886f0964592637e89e0649c0
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
704KB
MD55acfaa65fd39c4b1928eeaa8bd7a54ef
SHA108721766d7cc70ae6b95bd01299e54f218bb7746
SHA256b8c98bf850d49bc7e2775802097058474b2aca757267c1bbd000270c70554a9c
SHA5125bc761ae2d564b6a049d58f29023162f2e9e7654d5d13c5d62e35916c8c59edc869bbe390f87b2f3065cb7afeb2d4a608c411f260f77ad1d04b46d4893d5a695
-
Filesize
39KB
MD5b2626bdcf079c6516fc016ac5646df93
SHA1838268205bd97d62a31094d53643c356ea7848a6
SHA256e3ac5e6196f3a98c1946d85c653866c318bb2a86dd865deffa7b52f665d699bb
SHA512615cfe1f91b895513c687906bf3439ca352afcadd3b73f950af0a3b5fb1b358168a7a25a6796407b212fde5f803dd880bcdc350d8bac7e7594090d37ce259971
-
Filesize
1KB
MD5238f4956cd51210dd354daf990896eeb
SHA1825adfad6bd2bf94c3039409569369ce86761c6f
SHA25657f73b7936ad4c8e19a368e2474262db3dc0dcea675afd3f6828dd1b1b17bc5a
SHA51224f6624d1399c090e01836329cfdc89c62bbab4ab88aea2ed9d7d146cbbb7a26492be1ce303212c5c677605ced3146f2143535dc8018874aef7b251aa0b91e84
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB