Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086.dll
-
Size
944KB
-
MD5
342cec4e287b2f1285f18c63c01fc5e4
-
SHA1
ba8832830889724887ef7ee003f2a3eed503e4b7
-
SHA256
8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086
-
SHA512
517db6bf9b425716f80afac7f2e6d897c2fecf84adfad35cec156809bcfb634ce4700b17f7d3810b5e9b10bbd784665097d62afa1e81f625b8827ea5e81cdec2
-
SSDEEP
6144:s34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTg:sIKp/UWCZdCDh2IZDwAFRpR6Auk6kK
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8b32751a6432113ee710babcc5315a8aabf4b5a3647bf15aa345a6e3dd63f086.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\S61QiQ\DWWIN.EXEC:\Users\Admin\AppData\Local\S61QiQ\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\LhHV25mmA\wextract.exeC:\Users\Admin\AppData\Local\LhHV25mmA\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\cJUYgiD\msdt.exeC:\Users\Admin\AppData\Local\cJUYgiD\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD50318c7c54337601cbc02a892f64b7fcc
SHA17f44f440d7e48ec83ca34ebaedec3a17ab2fda54
SHA2569730b06ec5b45db1887e4e20af6e8fc7dade3f35900b0c2c092db7a30f4e7688
SHA512b7e0d047d32c6c08f3a45a061e39d13ee6372c766a8966ef9bf863b44a132a7e7d7b66167900c1f79a215031a3573cb051c3f9349f114e46d14bda13438cb2e9
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
952KB
MD57d4cf97ed530d24e7cd57261ed62f166
SHA19550cb58b8996a50aec73f8eaefb2c03fbe1f612
SHA256b38cef557ce5ae386097239d5a2f8485a56ee1715676a080c91f14167f18e11f
SHA51211dbb68e147b44f705785a0e4820f1f47d2921948362374442bfd9e22ee4bfcc5fadfb0547df4aa65516c567d1742d36ad251ade1dc50be6e34883e2046a39d6
-
Filesize
948KB
MD54644760f4f9c9b5edc42054eff247586
SHA1820b8b83576f9cadb2a8ff497d5b61d35b5c6cd9
SHA256e13fb4501c375aab6634507e38acee2789c5a0a78e04ed408a9d862925250134
SHA512e5e17c4f5021486875b3dc3a7eb6fae5a57f34361ed23a2bdc9c88c1a5f0d4c84ceca8113b5c5a05a7110c9a5b0368feb9fb7f17d1b4e45fbc4b65419b528163
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
1KB
MD53e6251fea8a69706f13f3dec9daaf7ef
SHA1280ae244d9bf5273a534c97d605bc5a011dff592
SHA2565b580dda50cb9ead8cf770448ab5aecac2c146821bfe6e6f5073c4238b8b994e
SHA5125ba99531e9465bb2b2efaaddb6e934ae0ad2948d02756d80c3c83ba6553f4f5118cb14780126aba304cfae536ecb8bf37091aa5b29843011ac8253cd1e04e257
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB