Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 14:39
General
-
Target
328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a.dll
-
Size
696KB
-
MD5
09eac984a186ff4bc57bbf0d7a04057b
-
SHA1
fbef060f577b7aac6346db2072fc852aa4832b20
-
SHA256
328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a
-
SHA512
a690df7c00db4aa59b6a19995754820fc704a8f3524ce4394f8f99e2086b83ba835be63e490e63b59641c2e5ffd7cd575a4313021172351afe5d986a6a50980e
-
SSDEEP
12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\QuSyFo\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\QuSyFo\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\jHHVFG\rstrui.exeC:\Users\Admin\AppData\Local\jHHVFG\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\IyYJ2NB\lpksetup.exeC:\Users\Admin\AppData\Local\IyYJ2NB\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD52dcf730e676328e34b149a28246c66ca
SHA1d6d1019ddcb80b254b25ba207700e303646b06d3
SHA256669eb5828e8d3e694be7da09478365485a1b3fe8c6f2d10007d1f035ddb2b1fc
SHA5121108a3bd92e2f873de44015d047c43f55ba9d9b532c2e3708466275bee5960e1f596bd505e4d17f823a9e8cf7afa7e90260ed8bff5a85dee4afb41813f1e0bc7
-
Filesize
728KB
MD5c75516a32e0aea02a184074d55d1a997
SHA1f9396946c078f8b0f28e3a6e21a97eeece31d13f
SHA256cb3cbeaaff7c07b044f70177e2899a87e80840d177238eb7dd25b8d9e20bef22
SHA51292994fdb75b15742e33e6d7a499664b722e45b9c160d8cc42d30bc727044063d589f45853692b5b754df6ff0fd21294dc32fed985b153f93f4bcf9f8c89a5bcc
-
Filesize
700KB
MD5ca6f2c03ed9869ee95135ede4a435622
SHA184adbc0cd4d2b5335573440342c68bfeba88e019
SHA256410bdd4cc81533d404a6f921ada4e3c37c4150d30d3aed186b5c75b64eb8bff3
SHA5128d713f41ce397108a313b24d515a6298969ee164a928f6ce3ea02a8fd8f8b523d2f661db5a2b3baef767e0e35897282d31385ccf7c6500dc6277b1ea1b90fb71
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
700KB
MD5bb3ffccad97e10c84d947d0e096a9c77
SHA1a333401bd996e74cb109281d646a05db18ff8bb7
SHA256ccb101adc0d21e857dd9586125619cde38b5b2914b3bb271fc6a2cc970b43611
SHA5127d11d671a052bf45ad5af62ac39d0dcb499e3d783c63357ebba9b976dd1b1f14a4180d4a0fcf0f804ac526cabb41cd5caae2614b7bd169753a0cf1ca79919635
-
Filesize
268KB
MD54cad10846e93e85790865d5c0ab6ffd9
SHA18a223f4bab28afa4c7ed630f29325563c5dcda1a
SHA2569ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b
SHA512c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6
-
Filesize
1KB
MD585e4f9abda03e539780fc8a2ecf68567
SHA12a6112956e9cf808567118eac052d37ca420edbd
SHA25690e1d9a4500ea7f7bbd1024c8e75fdf569cc45dc6f2a90778effe1124ecdb5dd
SHA51289154951e3a6104ab89dca4ac6bd622ca3388fd39aacf9a3e4f30c56df5c59f33229a453a453b4a8d23cbbbebc63f5886bf89fdfb0105184fb21899bb987f9d7
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB