Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 14:43
General
-
Target
87f7e4782faff19b704c3881d94a1ba35fefd2ffe10b55399af5a9ca43227447.dll
-
Size
692KB
-
MD5
65411740b33c7475d67552a92d3c4054
-
SHA1
d1191e086f3faa2f2168a28eac66d7360c94d5e9
-
SHA256
87f7e4782faff19b704c3881d94a1ba35fefd2ffe10b55399af5a9ca43227447
-
SHA512
3bdb279bba9946af41d4bccc9b2bed4c8f37fc03d0cc53d0845311645ba39d6a30ca0e8d6bbe7bc8a1d94c8cacaeb8f515686b226e59b8ec06f6d6242c85fb03
-
SSDEEP
12288:cqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:cqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\87f7e4782faff19b704c3881d94a1ba35fefd2ffe10b55399af5a9ca43227447.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\6OsJc\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\6OsJc\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\kBCJFjuT\wlrmdr.exeC:\Users\Admin\AppData\Local\kBCJFjuT\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\4jErG\OptionalFeatures.exeC:\Users\Admin\AppData\Local\4jErG\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
696KB
MD5df21b485a10c385c1639ad8d700e7145
SHA13fb4519e16f3eb802958a797d0bbdf0da96cfc7d
SHA256636bcfaf5cf6b82149d067b53588f78a08aece0f6f37c01a0c1b1e37372c6c22
SHA51253d4d93292d5e40565713426aa4791cff6777d7a2f27ba96a23c4e0d7eb912cef48c0972eb725276b362a1ab980aa33cee44941e309fd38aebd5e38e5e5c5274
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
696KB
MD5f094cc0d7ecc4cde4c697bb973dcf563
SHA1e87f6423754e430ffe28f113a275c963993d128e
SHA25649c951943bef168300888ddf1c6249ae7b44cefd1dde0362d4af8dce143d7473
SHA512d978f2bdedda14af1911f93bb0f8b98a8ae1b80f98c0f3e38cdf92241b5e89b37f39399c0d11d85d8d2b0385ae2bec2958ee804afccfcd430015ce1bc89a8c76
-
Filesize
972KB
MD5000a83b8365c0523ade905b845df0a76
SHA1d594d7896c909cb10e5012d69e3dd861c3590a7d
SHA2566c61e6fd3879f8a58cdfb4f68978025ec29200118e11c7da8dcc39893e4824f4
SHA51246e96e1df1827ff77cdc53cf6356ff7ed08ef40f1a745251869143492975a29bfea79c605270c9dca0af2f2aedd5f2646f8af2fb7732b9fbaff915fdb21cc711
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD5dc0b0bc9cd62908ba636a5785ff849d1
SHA1edd3dbc6ee7d60f6ba6ad32dcf5819d2ab66d27f
SHA2567f4b2fa9fc5e1752398dad44c21ef1f6e528f61e24b4da6ae06814a05769276c
SHA51214d50b2f963053c0ecfd17e2d627a01d363e71ffc69cb0afb5fe23a9dcd25fbc6c3a02b0f72a1ed8b96c87bc357ca54d4eed4652cce3e634089429950c4fe9f0
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
28KB