Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll
-
Size
668KB
-
MD5
180c0aa7fe397e299b050b5a9fa20041
-
SHA1
7c6f6b915e18f322b65187b831cbb5f68ed02c09
-
SHA256
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a
-
SHA512
822daa11c3f169efb36848e9ac0e0ad391d9401cb8d329cd3b9d1a0dc3d5aae029f356bded5dd625e44ba364fb615b861846c5d580dc7d65b4faeccc9ff5fea7
-
SSDEEP
6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\2UP\calc.exeC:\Users\Admin\AppData\Local\2UP\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\AdGLyMw\BdeUISrv.exeC:\Users\Admin\AppData\Local\AdGLyMw\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\mPo7d4j2\fvenotify.exeC:\Users\Admin\AppData\Local\mPo7d4j2\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5f8defc064075e84042afb4bdccb7aae3
SHA1148355ef8f72a18f0a4da76401084730e7a40272
SHA256058f2fe03ff227c3ea7980d8b014f5b1bb4fab1f7e54cf552b836c5542dc0c06
SHA5128079f86fdcd35e62e749380433914a041d3eca9ad1dc26642fafab048f167409fdce9d6d11ca4e77699ab5f771bb266f8f164911af72d8891eccee4c29485ec8
-
Filesize
672KB
MD5d0619aec474835eff33d1c579b1c791c
SHA1f416db7540ead3e7a9ac1f629f30e5b26924cc79
SHA256e7c944fa64cc1c6026c97c6f8aeb4736d7ab2f743f68ec2aff316e2837bc5da0
SHA512857d9653bbb3d32c95c118beaf3c1b662900c9d62a09c275199b4e5e94701bfcb44b600549ca50ffd4adc52c27fb08bafc6969ddc67b59acfbac7985237d9d47
-
Filesize
672KB
MD5947975c619ccb5681f781f18d04e6a54
SHA10b239868e42e5ce46ad30889633f7f35beef581a
SHA256dde88d1896e001eb700a5dba3616b28b5f19b8c54c0e1dae09a0a43a3ca2eb83
SHA512306731666ececd31f740def2edf8d1f8bc48fd1b4713dda28ccfe13bbd0b84199b9cbd61a0866f89e70949e3f80dcd7aef98bb9d2b17abec892535babf016580
-
Filesize
1KB
MD5b04a9ca6d30cde06d8eb66c0c453af95
SHA1851a89e2a0f58aa85e161befb5492f23530dbe4a
SHA25609f24e71204b1d9a017dcd5748507f940fcf902bdc3d1d25d1cbbfcc4f94845b
SHA512efe90b7bb2666c609147339ab801948690d3aad68b277e417e937c10feb9e3d3f8d75fbf0d2ac6083b8f416cb866136e10b92d41b23401e81998d7b236dc4ebc
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
47KB
MD51da6b19be5d4949c868a264bc5e74206
SHA1d5ee86ba03a03ef8c93d93accafe40461084c839
SHA25600330a0e0eb1dbb6ee84997963f8e15c7c15c1df787f1c7f109609d7b31bd35c
SHA5129cee858c55eb0852e5bad53a675a094ae591b46b07afe9fb4224cac32e0be577fe36c1ed3e9f6bda4d4eb0c924a773d00e3181cd97f07e24c6c68c70f2b002c6
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
672KB