Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-10-2024 14:49
General
-
Target
328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a.dll
-
Size
696KB
-
MD5
09eac984a186ff4bc57bbf0d7a04057b
-
SHA1
fbef060f577b7aac6346db2072fc852aa4832b20
-
SHA256
328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a
-
SHA512
a690df7c00db4aa59b6a19995754820fc704a8f3524ce4394f8f99e2086b83ba835be63e490e63b59641c2e5ffd7cd575a4313021172351afe5d986a6a50980e
-
SSDEEP
12288:RqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:RqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\328aa9b1065fe77cc18f9c738b30eb12b1c1bb7c857fd91b075440d5e725885a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\ZIPSJAoX\MpSigStub.exeC:\Users\Admin\AppData\Local\ZIPSJAoX\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\SHqnuM\Magnify.exeC:\Users\Admin\AppData\Local\SHqnuM\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\dTjgc\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\dTjgc\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD5b782f23cf270045c2adaabfe8282cc87
SHA101e126928ea6a6aa29e36ed6fc24f69ab1391ad1
SHA2569d6679d9b5a11f8224ba639ddc596f2b5a687a369a400fda7099e0c213f5cf05
SHA512812e72609d5081b952b1e64b8d557a652c92144bc9b6ea4966955c6a943c5ae999bfe1ecf6f2eec8ad33fc13e155543c8020ff7a227bf6684692938dd80041d8
-
Filesize
700KB
MD52d392089c25aaea94485455481d755c3
SHA11642424c62702d3c6857dbe1f1e1a46f48bdde89
SHA2567379ef5d513c2ad459df7b04dcd876f305790dbc9f6e749492cfbb95ba47a76d
SHA512b09b1e58f6a18f7b1c1f1511196036a86c0a4a1f1cc7a59ba538a46f68472830dff5d8fe5675f893781fe6831227d84c18f2ff13f9ec5884792150ffa1f3a75d
-
Filesize
700KB
MD5a74fc12a50ee4b9f195f005edc850abf
SHA12f634694847e88a8ba5a61f71ecfaf1211e43cff
SHA2562b8bf40849b90f649a93fcb4c983dec43061c22dcfdf64fd79e68cfdd65121bc
SHA512496fde8d7f6223abc2df89d870e3f10e008206771bb35d3ec8baf060922a116970e98e1469a72857bcbf27cffa8fbc8f5ac7354bf39f20be7f81b2c28b6e9fad
-
Filesize
1KB
MD59295e649f237496f91c908aa43237ec3
SHA1562fadb6889fbd502f436ba08c8fed18efb7d562
SHA256b06b454d98000458a0fec8fa64f05ceedbe6a1a4a3d420af1fb2f2d825adddb8
SHA512642e7c5b8bb3df85b8483c4082707cb554933623a3922000fbfdd8a2c1e88bcce7aa9cdaad90cbc22ee0e568a45116eae2f0a059255268e5a8964d02965c1298
-
Filesize
637KB
MD5233b45ddf77bd45e53872881cff1839b
SHA1d4b8cafce4664bb339859a90a9dd1506f831756d
SHA256adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a
SHA5126fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
700KB
-
Filesize
8KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB