Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
aa1b8808ff9218215966c40200f6c4364ccfeeac09577d53e4070ac340c921f7.dll
-
Size
668KB
-
MD5
98dc96aa9c3710d257132e09fb20d7be
-
SHA1
d88827076938c59663be2404e1d3b225b39b677c
-
SHA256
aa1b8808ff9218215966c40200f6c4364ccfeeac09577d53e4070ac340c921f7
-
SHA512
57c1b0de9117d953848428b8e77e0a08d66f04472f337d028138476ec7b57ac7cf28121d8ee47a3c430cdf13fc0865fd11eeb6050db3e80d83453dd8eb3ddce0
-
SSDEEP
6144:434xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:4IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\aa1b8808ff9218215966c40200f6c4364ccfeeac09577d53e4070ac340c921f7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\MvIRh6O\upfc.exeC:\Users\Admin\AppData\Local\MvIRh6O\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\0je\sppsvc.exeC:\Users\Admin\AppData\Local\0je\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\wtMjvVqqj\SndVol.exeC:\Users\Admin\AppData\Local\wtMjvVqqj\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD59b5c4bcf41b3a99a59d5bad8c0f4dd50
SHA1419f87a70a56aba8938c86c5bc909057c82f238a
SHA256c7ca6abd488f4fad9f92659614b91588c1cec53acc3cc498c1f1ed397d92b062
SHA51227e73c9ee0f581c0f8b147cad4c5a064a981d23d4ea6c1c080ae4a963fe43bf635f31e30c8ab5cf590c9f9da91e3645929918c9021bba006e73f3514f3903dee
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
672KB
MD529ba49305b4d732dd2d485d9bdc63bce
SHA1d351d34254e49216b5f1e5d1413ecc2a118b0458
SHA2568194dd8bc992ba8722229d2f590f20c3d062c5bf11c7eb1e50db6e50e05c70be
SHA5125d1b4ae664a9f8b8e7f8c7e285a944d9811d9d19f1b25abb43a05f86736d45e841214143147b53d0bd96b8f2e7830e0dea47e91c836b9aee73ff3eada72b5dd3
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
672KB
MD5a091482f96ad3cd0abc486356280fec0
SHA141c79290d89a8a5c7be06122fe0f887ee6117073
SHA256d1c5d0b17da1e60f1ba29291439bc199621a00dbe798039b014c06d392c760b3
SHA512eee97e34fc7b175386cc13eebe83573b858c298b22460cbdeec6db51d0aa297efe989241a43e2cdb2e8560278f1bd44e20e23af553aa3ac5789bb6f1a7f07ec2
-
Filesize
1KB
MD5ff2718e982455de55e369005ed6ad09c
SHA105dfd31952b3e3e7a080f1a449b2e726582ecfc6
SHA256eb1666fdb010c7dd4756f5f22e61b259b8f71c86d06269dae5b99cd668098437
SHA512aef19144ee37551ded3a7dcf32a5444007d26fab69c831c3de09695ca049acd1112fcb131d7cca93628b0bc073d905f6c07115d3a51d1aae0d8abc29353b62fc
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
28KB