Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-10-2024 16:35
General
-
Target
b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f.dll
-
Size
692KB
-
MD5
c2b6f8ebb1dd8692d134ed9dd9891cfa
-
SHA1
1a1eb14433d4be1fb5e464c913a478f286fbf991
-
SHA256
b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f
-
SHA512
a6a938cdb0718f6757cffbf122d7f36420b78a20df3727872469c8f4bacf131d5ea596c90b148771e95c89cf9ccc10388f36e19098e491c1dbc0a96ff563befe
-
SSDEEP
12288:wqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:wqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\NO93utIaE\DisplaySwitch.exeC:\Users\Admin\AppData\Local\NO93utIaE\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\xCI\tcmsetup.exeC:\Users\Admin\AppData\Local\xCI\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\MVvq\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\MVvq\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696KB
MD5ada8bf7c75ea835f941c16f321dc9f7c
SHA1744f89d3212d3b218e33a4ad68e075378beb0282
SHA25608a2a94757b34280da41d4b54a17245f4438f0da820434ee94d13eb694bd99b5
SHA5124e5554df795c34a0f8974359325fd20c4ef8eaec96ca5733d2314f24292644ea4217e41bb87d45241b12faf008af7673fd63341d0ff90400e42be33a913659df
-
Filesize
696KB
MD5261e90d423cb864973bbb086e1068c4a
SHA18feff2f8cd1524e13ac20f1e312319117868e6d1
SHA25655634ce7189791496f5ebc05d07431f6f5356eca23cc0192cbc1d7bdf399e670
SHA5127a2505a377b94deab57db637c523336537d34348d314e70217bc05b7533551299404b8b142425ede238d5ce9600324e74b9f917bbfe379e5d756fad4d67fb274
-
Filesize
700KB
MD5f396e8b02c503da4250fa86f5cb626ce
SHA1db118f4f2c1a445d203ee528e49dfce3c469b2a9
SHA256001dff616dca9c516543d4ca1b823217c015a3eabe638e471881d943368977b2
SHA51251e12df58a314f5c1e39d5a3df2ac67402fb1b10f73462d0fba830ce4fa83260cfa0754905546c3ca52ad1f3e8a1ccb74eae20085259080564cbbd0145e4ded6
-
Filesize
1KB
MD5bea3b2affd1ea24bce7e15fb64e8dc15
SHA12f8e78e9bd155eef344a1fe78e8ef2ccd1f2cf2d
SHA256f02209f9feff387e9415342618e9ddf9481167e99b4fe6611912de5712d0c1ef
SHA512896be449a494953adc263d61ea2a259826fa607053c38b7e9a5fb48ae4b48556b8854775352a7a090e4726308a9b5883ca98bf2b9d12232bacfffbe18f73f7cb
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
692KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
696KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB