Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-10-2024 07:40
General
-
Target
4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll
-
Size
968KB
-
MD5
5453dd8223f092553390e303d02d3160
-
SHA1
db579b41e2b925e52a32d67c44d5efadcdb52c91
-
SHA256
4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f
-
SHA512
9b3f0cca2e9b8d1af6b86a232606a57a44480f08ecb5854539f517a56d229a7b3a227cf7415caee70f040ee79cdea6cce0139ec99776664785966467199ca82d
-
SSDEEP
12288:NqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4BaedthD:NqGBHTxvt+g2gYedth
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdtc.exeC:\Windows\system32\msdtc.exe1⤵
-
C:\Users\Admin\AppData\Local\TTL\msdtc.exeC:\Users\Admin\AppData\Local\TTL\msdtc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\N7Bn\irftp.exeC:\Users\Admin\AppData\Local\N7Bn\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\jlFgpcFWu\calc.exeC:\Users\Admin\AppData\Local\jlFgpcFWu\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
996KB
MD59db815e90d792a25661ac165f1378be1
SHA11379d4661a134f93f907b0d2b3638a67f1ed225f
SHA256493fdabafc75c465df92f7d3cd0c1f5b118970b0f4fcef38b70ef05e394ea386
SHA5120c0e28b6b926c285410c5707835932d882bd601eacd669fb9c06923bf1ac3d02bea15732726d0d7d2d6b30bf34b775a4a93f770fa749f39b8d9ffc0789292355
-
Filesize
972KB
MD55f7f8417946f915529a8f05a4f55e406
SHA1891092488537c29aa1c23e675c821da37fadcea1
SHA256c399d39ebf667b4c5a7fed8dbdec3396a5e1f6212c3ae5590e94d1d79bc77a0f
SHA5120e1a0e19bfca6f25d6629a35bc401bd8ca8efc0e13e0236e60a48cd2c7203a346c375a6d82bc26fa00fb000ee8f698284be6addfbe2fe0dd8c8acf34bf579960
-
Filesize
972KB
MD589ceb64395e5102ff681b16b9eb86c9d
SHA14a6abb9b1d1abc667e698719fd1a48f302f5d9be
SHA256117ae950614e3f10561986a2b7d1e5dc3a8bc651543e34c0d8b65040ee1bea50
SHA512f15c38100dbd01ce4d916586d4c5e6f0bd10774577b635409370905538a547e817f19326f6785ef01df6c64cc2d0171493c40e002cad0939e548d21b481df70c
-
Filesize
1KB
MD5f78c941ad1edf5e5fdbf92bfa2110792
SHA1b00c724a46cc239a4d459597f14ea33f6f064fb5
SHA2560ea6ba56ec87f689601659f3397a4e51f9beb84d71b9a9af85d465e5e49ee4d8
SHA51204e7c4cd97d9d70494b3b68750d1f076e815b0868e3f817cafd818e3cc96faf108716ac054a5ad8f97d453f4d0ae03d9607375c8ed02c9612107019b4668076e
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
138KB
MD5de0ece52236cfa3ed2dbfc03f28253a8
SHA184bbd2495c1809fcd19b535d41114e4fb101466c
SHA2562fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3
SHA51269386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
972KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
996KB
-
Filesize
996KB