Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll
-
Size
668KB
-
MD5
180c0aa7fe397e299b050b5a9fa20041
-
SHA1
7c6f6b915e18f322b65187b831cbb5f68ed02c09
-
SHA256
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a
-
SHA512
822daa11c3f169efb36848e9ac0e0ad391d9401cb8d329cd3b9d1a0dc3d5aae029f356bded5dd625e44ba364fb615b861846c5d580dc7d65b4faeccc9ff5fea7
-
SSDEEP
6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 6 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SysResetErr.exeC:\Windows\system32\SysResetErr.exe1⤵
-
C:\Users\Admin\AppData\Local\YyhyNWhHu\SysResetErr.exeC:\Users\Admin\AppData\Local\YyhyNWhHu\SysResetErr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\gKCo8F\dwm.exeC:\Users\Admin\AppData\Local\gKCo8F\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\yDyN\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\yDyN\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD582b776ea2e74fcf70bf0bf9f50be3349
SHA13293d76d40a8011b6bd27de2e95eafe9834fa6a6
SHA256bd0fb43ccd9cc646ff1c4840e4053a2b978cfb5c7c3bd1c300a2c8066ee317b8
SHA5129a18bc4692ee4bf19a68e786feaf8548e7eb82d35ac6e200ab0c5fac84b8de9e9d7bec8d9e81d99e85a2ae7b533bffb7b5f03b210e89570f6e33b152da8bcf10
-
Filesize
41KB
MD5090c6f458d61b7ddbdcfa54e761b8b57
SHA1c5a93e9d6eca4c3842156cc0262933b334113864
SHA256a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd
SHA512c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
672KB
MD5ba6353b6ca7cb994a343a25d3540d7bd
SHA19981481b88cf791ddd3188c86cd20444a6c3df72
SHA256dfff625e011938bf96672679efcb4d5c0ee030708be46fee40a6f51e6857429f
SHA512667a50369d192565bd55de16412998d6f09c6a0e271fde0bf1ab539e018a08f308cfa6eef540b68086a988f46b83b0dd8a8299e2b2fba46a7cd3448abb5e591a
-
Filesize
672KB
MD58d51209636bcffb788a53397315fbc86
SHA15e85ad6630fc3ebc014c9dc38b2e600dfc4364d2
SHA256f0de41d954fe3e113aa12ded2aaadeb5c75801a18bfcb93c0e8127c31c01921d
SHA5128a4e4ecefe13ca8b21b324b8b0475a4825b420d4fec3360b1304d57b48e5a1389dc436a4904e0fc380652ab54f4a2514ce01e115cf12e5d814318bd62f74a915
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
1KB
MD5acc7bf847ed1999e23e036a0fe5763be
SHA14ecc152edd526046b7434b3aa8340e8aadfa8119
SHA256b506b6ae7eb07a770620bcdeeb55fa9c121cb7a56127ba4b47e5896b0e71c949
SHA5123bb4ae555ee3d8112f24ec35db07a91d34c9e8c5c29a9575fb33bc03ef4e24439e4a7f4ec7c10bf2013035f235cc1777f035e15c95cb155f8c93a6a41eec304c
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
672KB