Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 17:31
General
-
Target
075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285.dll
-
Size
720KB
-
MD5
547cff20a7fecb219285e1cc582b413c
-
SHA1
4407b461b33bfaf3092ac7d8a8d9621ed2fb6200
-
SHA256
075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285
-
SHA512
a0f789c5641cb62335567f533a8b86e8da02a5b66698e9e1cf21927161861f6a74b847f115c73c35c4d19dffec12cefaf90f5a9783b1824b52481cc49b3a841e
-
SSDEEP
12288:5qJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:5qGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\0lnH3Wq\sdclt.exeC:\Users\Admin\AppData\Local\0lnH3Wq\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\lRdblZZC\rdpinit.exeC:\Users\Admin\AppData\Local\lRdblZZC\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\wZjl60y\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\wZjl60y\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e09d48f225e7abcab14ebd3b8a9668ec
SHA11c5b9322b51c09a407d182df481609f7cb8c425d
SHA256efd238ea79b93d07852d39052f1411618c36e7597e8af0966c4a3223f0021dc3
SHA512384d606b90c4803e5144b4de24edc537cb22dd59336a18a58d229500ed36aec92c8467cae6d3f326647bd044d8074931da553c7809727fb70227e99c257df0b4
-
Filesize
728KB
MD5999539dae1875d1226664580d912ce48
SHA1d93a47ee683bfc2cdc721c3e3105060e2e87494f
SHA256b3adf9461d467833bb6f49cb4148b220af39f416e3824674da9573193b622c29
SHA512ad0e7a6450137b497e04462123f4da5e6dd53787d52bb05b6269099db6597bed3849bfb1864f804366d8fd76068e7006f84a0161df55d3531130d2ecb0173fe4
-
Filesize
724KB
MD5d0b5d00212def523ca56931335f00044
SHA1cefddee2a9bacaa0ffb399a8973ab5364be6346a
SHA256b9cfb72cbebc5706d51ef250d0be3a748d4bf26c1450ca3f443de9428cf1e75d
SHA512011c064a07406d24428c78a793e2ab7509bb936725bd44e3cfbfb277c6685472b87058fa449149b3fdc15917faa298215a4d8740a8834bcf7e4f7eebecb83db6
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1000KB
MD55ffed68c1cc6833195d8af7735d7c8ae
SHA1dac0fc34d9cf290d27ab5e4837589b63c8568df4
SHA25616d92cb7dce581684dc035fc64c4c0f477f78d4aeff8e1dad98d2248c30e41a7
SHA512906e1d87311d6493296c1d7778649028a8b599a65f9e5dc9c313acfef841dbf52ce9f1f189686d392a928257a37d62aa89c5aa733e5891526dba34ad1258abee
-
Filesize
1KB
MD5a9605fcc6119c3d4450456b5e857e71b
SHA1506393aeb47eaed7c84d2ac1d1986477c83474e1
SHA256b0ff9bfdcd98f614d199b3e58719df2aa39d4a55c72ff18c03a96e69cadf9bb6
SHA51248021f972593e301efd486e6e49350848746a44f1acc92aa8e5ceca9549f73c6a2ab0272ebfe92f8c2c5621dcd16ad2e0ebe972b01b3cd1aec1f0c94fadc1321
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB