Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 07:33
General
-
Target
4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll
-
Size
968KB
-
MD5
5453dd8223f092553390e303d02d3160
-
SHA1
db579b41e2b925e52a32d67c44d5efadcdb52c91
-
SHA256
4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f
-
SHA512
9b3f0cca2e9b8d1af6b86a232606a57a44480f08ecb5854539f517a56d229a7b3a227cf7415caee70f040ee79cdea6cce0139ec99776664785966467199ca82d
-
SSDEEP
12288:NqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4BaedthD:NqGBHTxvt+g2gYedth
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\j46xnG\rdpinit.exeC:\Users\Admin\AppData\Local\j46xnG\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\L7vWT\upfc.exeC:\Users\Admin\AppData\Local\L7vWT\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\CkglG\Netplwiz.exeC:\Users\Admin\AppData\Local\CkglG\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
MD5ce8af5226097a63f4539cabddded08be
SHA11ef1fd017a9c9c8cbfeb98e28da1e43ce26833cf
SHA25601963f2fd539d45f3c14dbac2f4711172c638e7adb8bb8539f98adecd0da7d5b
SHA5128061bb09b8a58bb9d140d724ea6d80abd370d798b8e9b5ad14623c03991599ba01b7a2d3c1be978fe7441563a4eb3f1937310d9e68d1a1bd3e30fb157f82e393
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
972KB
MD58731b45bdb9e7db214a02b10d01a9d46
SHA1597a060219b916edb21820656872276029e275fe
SHA256ed8f891beed858106068c1563818d43542a708c19ff2d26063cf356a6108904f
SHA51282ffb14fd26bbd666b9f7caf285ba2c21c50f1f50eedf6c0ccadf172b006ac48f2f1f8c57ace29a363a83d2d805e7e8bd5fc92b9feb8012d8e804ea4ba26c51a
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
976KB
MD54ca8e6d980289adbaf419536c135c753
SHA19e58533cf3a9a1fc954d45de78a69faf944fd37f
SHA256bdb6b57cb85d5b5da5838bc2f1d47418ef8780d9a4909b7a016697c5adbe1f95
SHA512eddb0bccec6c2aaf09fcfe37a4f9c87623bafe25ac1eabfa7a0ee5fc42a5dfdad2d68004e138a291de15443615ad6cea94addae131d1e05186cb8bbcd4f085e2
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
1KB
MD5092c46a685febb0c409126f15bf5907e
SHA1bf20a4a08322b7233d98b762ebf22d9cde1eee7d
SHA256ebad2a99e1d5f38c895fb74a46af5a32334144bcd64b899982b99c28f16e04d8
SHA512c46120d23e8ad931deacb108feb16e37984e55d27da29e177850901d2eb1b007658e835f8b22f80345abd6b12eb1f7b344465dae873d1bb45a3f6c4db6d0e624
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
64KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
2.0MB
-
Filesize
968KB
-
Filesize
2.0MB
-
Filesize
976KB
-
Filesize
28KB
-
Filesize
976KB
-
Filesize
972KB