Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 17:31
General
-
Target
bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca.dll
-
Size
720KB
-
MD5
f859e1567e45f47b3b3746c4fb49e3f5
-
SHA1
e824cabc3b25fe5173ff02fbb4b3e7912bd71a72
-
SHA256
bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca
-
SHA512
bc5b15dbe0dbb3f77dca8839123c95e77a2733af33827fc911e24404ab1dd793f04cab91669a075ab7fef7f6fa1d64ef6c8888d642a862c07a90c41ea3ebc29b
-
SSDEEP
12288:ZqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:ZqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\yKxui\omadmclient.exeC:\Users\Admin\AppData\Local\yKxui\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\oLM60dL\OptionalFeatures.exeC:\Users\Admin\AppData\Local\oLM60dL\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\uSHhfla5d\consent.exeC:\Users\Admin\AppData\Local\uSHhfla5d\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\VoUYT30TE\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\VoUYT30TE\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
MD576def423cf911501bb917c954615a70e
SHA1087ab7734b5ebd87fb171151d40d7915931c9eb5
SHA25662af71eca31de1f87e0298b977d8a78b154f53d0ebeb40e704f63f3459585b4e
SHA512e6aedb104bcabc49bc041567e03e0e692b270ace2230a7af3155c74bebcbfa77dbd05ffa24345bd65ac3f2b373e777508f98be953079cbf2512a8c7352057c19
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
724KB
MD50852a772c24666e12c8169859b078330
SHA1f873d908b28348fffd5f1a1e2e6c5547095766cb
SHA2566e8faa077f2c86dd78160c546d2506346295a7b367c44fcf9f47de61d2b70e21
SHA512383e40a8ff2cc48b909422a334633ee86203222391f3058409f8f8a07cb4c223c1e4daf53be9764bab855ebf4ff3f568c1b58ee11c0fb95d41f11b32f5c343f5
-
Filesize
162KB
MD56646631ce4ad7128762352da81f3b030
SHA11095bd4b63360fc2968d75622aa745e5523428ab
SHA25656b2d516376328129132b815e22379ae8e7176825f059c9374a33cc844482e64
SHA5121c00ed5d8568f6ebd119524b61573cfe71ca828bd8fbdd150158ec8b5db65fa066908d120d201fce6222707bcb78e0c1151b82fdc1dccf3ada867cb810feb6da
-
Filesize
724KB
MD5c1b6cffd6f9b3eb7823f4f1684974c37
SHA1f4719ad068979cb32f9cc1a00eeee1b05a869633
SHA256147a02d2e8591f8f9476f6326ac8d4b1356464c84b2cf1bd6f2765e4cb13b4d7
SHA5128d1caa7b22c9ed34cf68560359c9ffa7f1e0ef58888c328c9139cd16af548015477510087ffab778728c8c0aeb0192ef8d1af622e33abb52680d5aa61c990f20
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1KB
MD51462ff63065d3f7f51509fd3b6a0e833
SHA1b6866523054ec8e0b907db1e73c9c8e9d5736c8b
SHA256d941d6c8ec2a5d459e1fcef450e13f1014264a6d9a7445b7a8d446ba4cfe849d
SHA5124b341c6df787dd5d69a9c13272fe05272b47a250175a30c0e75efad9332bfd6c16b095ce87cd885928cbecdbe1c1ec478d78d27e1d4c386f9ec61a4736a4826c
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
720KB