Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
915e01432b35339df657eb6eee139103d98a0a8b37a91fd3851e01781a7b041c.dll
-
Size
676KB
-
MD5
4158ed3f73bf010337896f8458e8fde9
-
SHA1
26329d87c00bcad276e278003d19995a5425053f
-
SHA256
915e01432b35339df657eb6eee139103d98a0a8b37a91fd3851e01781a7b041c
-
SHA512
7099602f413fa9dbb91ef2dc3208b106a264bba1e96e466ca32cb0772faf90f3358f82eebd5f5fc4b1675bc472bee9baedd68aa2c735fd87800f97da9f703800
-
SSDEEP
6144:j34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:jIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\915e01432b35339df657eb6eee139103d98a0a8b37a91fd3851e01781a7b041c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\NVioWHgg\mspaint.exeC:\Users\Admin\AppData\Local\NVioWHgg\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Users\Admin\AppData\Local\UHuN\recdisc.exeC:\Users\Admin\AppData\Local\UHuN\recdisc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\8o7Ma\vmicsvc.exeC:\Users\Admin\AppData\Local\8o7Ma\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD50eb1be9741ed61acbb3b193f90ca766b
SHA1bcbc58a38cf809b1e8c817f2fe34856bfd35eb08
SHA2568cfa89d1ebf4b2edf36fddcbb5babf14f1b4aa78f8b3089f5ffbdf470c5f8297
SHA512e23221774bb1ec5d1ba140c239727443b81a00bc220cf33bc57c374f25a8476651b3fd1e97fb49bae6221884659e44abadeb6343894f2a7bc4ad2ac0936fd24e
-
Filesize
704KB
MD523a6067ac08d4e1cee758c1a8179b6d2
SHA16621fa841eee637cf17e33c1c9ba9f37ae1cf520
SHA2562fb52e3f2f54b034052353de3ac41a3c3d50ade41589f469bcb1da222f55e209
SHA512c8fbb51c8ea82e42e2968183fef7458548b1c75ff5840f1c58557645d385741c329112ff68455fb2f54886c23e2bc8f0e059333fac1d39ec6293e564cf6b5a42
-
Filesize
680KB
MD5bde78c8c6f7d7f1f909df9d5f01aa0ad
SHA1610318a8d958d1ce704b6f78e6c21d8eebfec539
SHA256be0747168349eab0ebdf54c5e5aa6c480253867eeb588c4e7212a247f6647abf
SHA512e99cbac8eb1e2a4b2625f0a20c00905de06dfbd27c597a165b8407728dd67e786a7f59435e03bb00384fb9bd22b1ad5dc8f409c72007e77a69c3378f2c55eac4
-
Filesize
1KB
MD527f079b3d8f57866a07187cab5fd11b5
SHA1f676bb1aad515e5d84bf8fa6a4ec41eebef97633
SHA25601f96dad59a60c4c68192ad48b0449361cabcf9716a8a46f167155daefd10634
SHA51286d5aa215a2f7895dc75aa5fd06bd91fe92d5da66302ff55b4cbec64dff7126cf4d5028cb25ee5e03d6cd039dcda89a843dee6c82a401c2aa8c8c726b775f352
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
232KB
MD5f3b306179f1840c0813dc6771b018358
SHA1dec7ce3c13f7a684cb52ae6007c99cf03afef005
SHA256dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0
SHA5129f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB