Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-10-2024 17:26
General
-
Target
bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca.dll
-
Size
720KB
-
MD5
f859e1567e45f47b3b3746c4fb49e3f5
-
SHA1
e824cabc3b25fe5173ff02fbb4b3e7912bd71a72
-
SHA256
bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca
-
SHA512
bc5b15dbe0dbb3f77dca8839123c95e77a2733af33827fc911e24404ab1dd793f04cab91669a075ab7fef7f6fa1d64ef6c8888d642a862c07a90c41ea3ebc29b
-
SSDEEP
12288:ZqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:ZqGBHTxvt+g2gYed
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbd6d896a535b1e9b382eda903972c62e1aeb045c9fb4057a8aae51feb85eeca.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\StikyNot.exeC:\Windows\system32\StikyNot.exe1⤵
-
C:\Users\Admin\AppData\Local\ypARNfor\StikyNot.exeC:\Users\Admin\AppData\Local\ypARNfor\StikyNot.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\eDUm7EnZQ\rdrleakdiag.exeC:\Users\Admin\AppData\Local\eDUm7EnZQ\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Users\Admin\AppData\Local\pOKI9aWD\SystemPropertiesPerformance.exeC:\Users\Admin\AppData\Local\pOKI9aWD\SystemPropertiesPerformance.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
724KB
MD59494594a503d4bf3b6f7f449070412e3
SHA1373a937abf3fc23a3797050ee9403fe6f13f354f
SHA256a05979d8909fc50622db98f2c1815a81dad7af5875b980a1a7ff24a98b8dbd5d
SHA512a2a4f12cf271568dcc117805a001e4fbc043942667534d6622ce417f63b69cf4c5fd6756f8b271cc620a7aa06c5de9da560ca70dad48ef53b8f7637ff1ed3467
-
Filesize
724KB
MD5656eacacaff7c4e43fb656f12b06e923
SHA12f8f72c1061494c00d9a9b771df96586e0d97ff8
SHA256789e1a42d79a45628db130f57a09eb68ec2c8c84076319e3efa8d133cdbce8f7
SHA5123928cb47d03b39234b16fdc082b6b7bff8234c697687a9eab1cb4820e57b146293f1d31312c60ba922c96863555cfee77e4610eb43878f680c63a2d12dc5df5e
-
Filesize
80KB
MD5870726cdcc241a92785572628b89cc07
SHA163d47cc4fe9beb75862add1abca1d8ae8235710a
SHA2561ab77fa1ee0cbe59ca185c228c3c11abeba2b2008a162c91a06d3c40542e7fc6
SHA51289b961c2a2716fe0800e54e0206c8b349a26f1bc2a463ec9bd12f3ab22bfcb13e6402b4c20ddcf284d838a3c66e73335af8f6dc4554d76646382e387242c6f72
-
Filesize
417KB
MD5b22cb67919ebad88b0e8bb9cda446010
SHA1423a794d26d96d9f812d76d75fa89bffdc07d468
SHA2562f744feac48ede7d6b6d2727f7ddfa80b26d9e3b0009741b00992b19ad85e128
SHA512f40aad2a381b766aae0a353fae3ab759d5c536b2d00d135527bba37b601d2f24323f079bd09600355d79404d574ac59201d415ef64c1568877ad0ce0da2dd1d5
-
Filesize
724KB
MD5663a69e90fdc2bab98d7237a1231397d
SHA1da9f3d7b3c821e5fec7e698a92691d74577b41c2
SHA256caa18c30079d8aed09a3962e9e2c68c12cf2539abb68a5089cc17e46cfb03ff4
SHA51251743eebdeb6c0305419690531301681155beed4f0366b678575109757547cee760c82e017e18d2f990a91358f47c1af6fc3a6d56eb09b030d4266f9ff68d6f6
-
Filesize
1KB
MD5e0533d2920613f222c67a36b87ac7e1f
SHA1f9e02e26d2274a0e2c2d4d935fa2515cafa24a39
SHA256cad8cddb76065a402915d7ef4313ed5d188979515b940db7d428945e1ef7b9db
SHA5124dc662d5cf7797248bb232527dc6b2eab8982f50a0774e839c4d186ffea20824956860b1c9076141e0526440064476b02695818a0f87be08675f8a3de51d2bb5
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
724KB