Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:07
General
-
Target
0e11ca1228cbc474d5f0fd149fd3615d7caeadc4421cd478bb281716958e5a72.dll
-
Size
664KB
-
MD5
bca074a7366a91b631507914afcac0c1
-
SHA1
d15420166ea0070adb76b254deac7e50188b12a3
-
SHA256
0e11ca1228cbc474d5f0fd149fd3615d7caeadc4421cd478bb281716958e5a72
-
SHA512
ff9c141437aa1cd6a7176b2943ae1a134be32d5711eb03aee64cad8650b013c0c54895b4de3cb1229fa8bf2b940caac2fabca9e90d99c86075dc57adaecc5094
-
SSDEEP
6144:O34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:OIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0e11ca1228cbc474d5f0fd149fd3615d7caeadc4421cd478bb281716958e5a72.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\fzl\tcmsetup.exeC:\Users\Admin\AppData\Local\fzl\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\k65nT\rdpinput.exeC:\Users\Admin\AppData\Local\k65nT\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\wztkPT\EhStorAuthn.exeC:\Users\Admin\AppData\Local\wztkPT\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5fa0815d0502dde4e95b668b048b1c693
SHA1a9c8cafad808e321f65ae541cac3cc288ecc812a
SHA2565de5eb9e8c29c38f7e9ca71ad66136f074139fb998a79d473c4264d37b27649a
SHA512ff8f2d45058dddd5a21c8951183eadd71336a30ea68fdba91ba846eb2bd38d22edcc5f5fada05d02107da474c3788c8d443748f9d969ddc610b5254795b92da6
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
668KB
MD5ced1efad4da34141faa15a06bfe96c48
SHA13dbf028736fdcf5bfd4b41be85ef38665218cb1f
SHA256b3399e236a51c05813afde7e1e6b7b739e596db83fd25508b552d7fb6cfae2f5
SHA51295ba698283348bfa5b97b973d3961f6aa771ff81cc1c0819938b8c6d8c5d57083de6ca8907a7741fa2898a034d6444fd504acd25e07a9ecb240317b728565a9a
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
668KB
MD5c1d0e0545d8079df39901841a6e25eaa
SHA11875702795a5d515a9c26b2f0a6dac835ff2e853
SHA2569e1edef3755ad4d7fc45526dfd182071b524b3941717e8b25fa7f97de9bd10f9
SHA5125bb0e574857bf916f2868f52fd1f0f9713f6f9a447eafab3671b923496c7e3046ae496daf60f2a0f55cccf09aed94611e4bfd141d18f046ee7a17ae2a0e23b89
-
Filesize
1KB
MD5d5c7f9900e5ef1efd8f498ceb36b464a
SHA1273a709dd15d71b2072739f92972cbb2cd878910
SHA25680a18305f72940d99812d6f8a6edc6967ed6d8f502f23e247ec6bdca65178d26
SHA512a53b5a68ccc706785721a2844b7519264ed67e506c31a161c5e15250ded444a96f8af258f643c91cde1baa01b7f84ecbf6d1f40c338420517320ce7da8170625
-
Filesize
668KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB