Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 14:39
General
-
Target
05be219e193d428010ae2d069ecfb03840a7c731b83f1e2724b6fd1582a1c5d9.dll
-
Size
696KB
-
MD5
f7237ce6f2ea2844db1ffc53b74b57d3
-
SHA1
6807e9453325515ec348cdad087d182dc3804154
-
SHA256
05be219e193d428010ae2d069ecfb03840a7c731b83f1e2724b6fd1582a1c5d9
-
SHA512
2467a1e9bb2d046e13711851fc2d08d1fb903e8fee5bd40bc356c82d3633651f1072a191a582a09ca6bc0af0950322fa398440a99f0376239570de0a503b5efa
-
SSDEEP
12288:JqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:JqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\05be219e193d428010ae2d069ecfb03840a7c731b83f1e2724b6fd1582a1c5d9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\cqb\rstrui.exeC:\Users\Admin\AppData\Local\cqb\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\7GBWe\msinfo32.exeC:\Users\Admin\AppData\Local\7GBWe\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\xjRA6F\sdclt.exeC:\Users\Admin\AppData\Local\xjRA6F\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724KB
MD5496872e2b240a3021498fc151089234a
SHA1a1b345f773efc7a2f3adcde58beb6ba7a0df79f5
SHA256f67e57467034c0fe2c2858df4927e7b9893ab8811d55c5622c1b1b6116ee0c53
SHA512114ccd7a80f2a888e61480b06618463dca1936aa1ba23d81b2635dea021994d1f87bdfccc0aa22c1ca9d43371b2090c5891a9e35ecc37fd7b78057d42b04d109
-
Filesize
376KB
MD50aed91da63713bf9f881b03a604a1c9d
SHA1b1b2d292cb1a4c13dc243b5eab13afb316a28b9a
SHA2565cf1604d2473661266e08fc0e4e144ea98f99b7584c43585eb2b01551130fd14
SHA51204bca9b321d702122b6e72c2ad15b7cd98924e5dfc3b8dd0e907ea28fd7826d3f72b98c67242b6698594df648d3c2b6b0952bb52a2363b687bbe44a66e830c03
-
Filesize
700KB
MD55f73b27c5107687d70dab0dfad053c04
SHA1efc6aa144bb2836870f70d40721c8ec02ef5ea5e
SHA25610d4b1b02ce6d7c6d9e6bcb5610c40c818a53dbe3a8387c2fe638fdfd81930de
SHA512d763dfaf73d6d8a25334a2b0c3237a941d82e45f6d6480398206219741206354755c75e55c75385f0ab8e6957192cb760ad6eb9549e92ed7d1dd9152aa77b0fc
-
Filesize
268KB
MD54cad10846e93e85790865d5c0ab6ffd9
SHA18a223f4bab28afa4c7ed630f29325563c5dcda1a
SHA2569ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b
SHA512c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6
-
Filesize
700KB
MD57c3f07969af7210ca7dd252a468421a3
SHA13ce62fa3447299dd0f5e5818c282fa5c778b63d2
SHA256109912540e1effe76d2dbaeb5bd2e0743dbc9294f2f0b521aacaa4148c567cfd
SHA5129ce64b1d71b8a3d82079b45bae3352a428bf37a8d31e6e37beed99f1bc6ee0a213fba6baaaf84438d96a980b1585facb41eada490e4f2b99d38f037b9013ae77
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
1KB
MD59a700df1178df63e2969f3f4bd8cae71
SHA11e0f6a337fb66729808b3a45f7c67a582a8bd649
SHA256b6d3fb8973c83a5832028b4f801945687e05344d13c2c14c0d8473cce4eb80bc
SHA51207b8dc68d2461c45c9b9a1bf32c94b13024895958aaa7cab2f313ea711853716bec0e9fed44d3442153833a4b649601ceca523e4925bf3474a4249238c1ce129
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
700KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB