Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086.dll
-
Size
944KB
-
MD5
342cec4e287b2f1285f18c63c01fc5e4
-
SHA1
ba8832830889724887ef7ee003f2a3eed503e4b7
-
SHA256
8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086
-
SHA512
517db6bf9b425716f80afac7f2e6d897c2fecf84adfad35cec156809bcfb634ce4700b17f7d3810b5e9b10bbd784665097d62afa1e81f625b8827ea5e81cdec2
-
SSDEEP
6144:s34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTg:sIKp/UWCZdCDh2IZDwAFRpR6Auk6kK
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\AgyOy06d\OptionalFeatures.exeC:\Users\Admin\AppData\Local\AgyOy06d\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\KW7oMHNc\UI0Detect.exeC:\Users\Admin\AppData\Local\KW7oMHNc\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\OuPlp\wbengine.exeC:\Users\Admin\AppData\Local\OuPlp\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD5ad519b43b409b72bf6dc2cf609046b64
SHA1ddaca4aedbdf8ab738b95d5a29ee2ec54c89c990
SHA2567a28831eba37f46621630dbd2201087ec408b349dc629a16f092fb663dd656d6
SHA512086c6d014b7cafe6faf59de739e2645d5e6924832a869f1d0f5d97bacda8efdfe97ca5d03b02860cac1ee089b56f518ce8de4470ff447e170335a492388d48ac
-
Filesize
948KB
MD58d81d162752101fdda52cd69fb10db1c
SHA1fd6a845b903ba5c1bd6cb54d11874783be73b9a2
SHA256b8be53e8498d5b9f0fa043dc7e9bed6652712c076b1a05f6ab75570c23888cba
SHA51236f719f296a57d17c03010cc276420437164276f548270d40cbfd3ccbdd4ef89786ff13f414ef27d57cdeb14f2858f3f01bbff1361ec41e6a5e2f392647126de
-
Filesize
1000B
MD542550f1f3e62f8c6875bd538ffbec976
SHA110f1b86ca6ffa6ae5037359fd468272e041c5ec8
SHA256cdefddbf39d846527b761d3a87153149ff90a9d0322750020489a09d6cfb91cd
SHA512caa68f10708619e476eda670c40f4f9739e0df8a6412e54d8f2ce4aaee156f98edc86b93a2c09b252616c4ec52a38b779b47baccadf6649ee5520b2a6a038ecd
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
948KB
MD57b4f1fe010fbbb507dd2e9a3125a220d
SHA1ff5fe632bcf8cd38697e6b705755cc042881be6e
SHA256b716b782d857246cf26a9f84f1faf6dd927181dca92c336235be2290c4e42127
SHA5128f7544d831164cef4e460ca86de8c4c61714ff96f32c9c307472b350b8b75ea1b9776b201f14bc443c28218f10dac99c0aa92771e897a306fffa2f14fd285347
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB