Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-10-2024 17:26
General
-
Target
075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285.dll
-
Size
720KB
-
MD5
547cff20a7fecb219285e1cc582b413c
-
SHA1
4407b461b33bfaf3092ac7d8a8d9621ed2fb6200
-
SHA256
075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285
-
SHA512
a0f789c5641cb62335567f533a8b86e8da02a5b66698e9e1cf21927161861f6a74b847f115c73c35c4d19dffec12cefaf90f5a9783b1824b52481cc49b3a841e
-
SSDEEP
12288:5qJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:5qGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\075ab26a20020aabdf6ff42b86a7b852167bc3ecdb5bf72f7891bd639779b285.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\XLJ\LicensingUI.exeC:\Users\Admin\AppData\Local\XLJ\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\UABUIEv\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\UABUIEv\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\2MFBrQX\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\2MFBrQX\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
724KB
MD53160d022e72dd643e168fe8338dbdeb6
SHA13712f7afb850dbf9426a93c3864a9ef1f60e55b7
SHA256569a3ad41edcd22fd4226437929145da8a6406627f24b8344a1579cd887014e1
SHA512828dc7305c5e67f9edc04789fcca5ac2f00e4af0a3782a1d636b13c635f66844bc8a2e2be373cfab1c917c7b8051d8a3dc0a4561da7eda954a0a63ffa3598ff7
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
724KB
MD57c5bd2b3e22346eb924e35cca139429d
SHA17eb54de97855c2de69e64ba04fdc7da1ecddb2b2
SHA2564f76523cd0774556e588eaf197a480558b51953bc3f48a706489cd4224271764
SHA512d6b1c3ddf536ae87318ae2ab4c5d1c77750c34adf56bcf9093760aa2a90758ea892743cd7a1d12ae036ed8d70b8071062d40d6b8d618539e5ef2fd66c2eedb3f
-
Filesize
1000KB
MD55f852b18e98178d98835dbd21659c026
SHA1644fd577d420ec99b99ae016ad4cfd229e7f587a
SHA256eed53bf6d03e90135456a23a6b8a426ee40b57b3abff3a2d2094a17ceb2d357b
SHA5128620b1e297a183e6375b5fd594a4d77597d134d571a78883413ca2917c4ccc5fd5e67ac5dc1bf9c75865263b0b0b04d406e14fd81f8aa2edb64621d9daa5b606
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
1KB
MD5fee15b8eb8bb9473c21cd7b087974500
SHA192d4008dbb971e76f39aa412bba6296979fd56b9
SHA25657c5f120b67960392b7c719725d4c658148f42519dd29839870bfd8a17654b7e
SHA512dd5f8be89caaf43eff00c0c1c6fa22e5903dc2710d5461dce6f900a74d2354238076536aced25db61b7f029e1d67c6c138f1b459510942ca6e01d7c60c8ad1d8
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
724KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
1000KB
-
Filesize
1000KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB