Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 00:15
General
-
Target
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll
-
Size
668KB
-
MD5
180c0aa7fe397e299b050b5a9fa20041
-
SHA1
7c6f6b915e18f322b65187b831cbb5f68ed02c09
-
SHA256
e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a
-
SHA512
822daa11c3f169efb36848e9ac0e0ad391d9401cb8d329cd3b9d1a0dc3d5aae029f356bded5dd625e44ba364fb615b861846c5d580dc7d65b4faeccc9ff5fea7
-
SSDEEP
6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\k9ttrC\bdeunlock.exeC:\Users\Admin\AppData\Local\k9ttrC\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\02LizO\wlrmdr.exeC:\Users\Admin\AppData\Local\02LizO\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\jXYcok\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\jXYcok\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
948KB
MD5638f351b1b5db6ce1011d70d9e0ff86d
SHA13bf5e873847d08d44f4bddec9defa102e171e439
SHA256b80290f6db1701f808a512fae7ae2537acc4db650c866b48daca3630a393cc92
SHA51242145354a38452167f76c6818f939011a5d458ff420826e156b308b7c06575ad481b762307b4917feec50b3bd8bc053b2cdb771eb3bc2961c1f25796a2564569
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
672KB
MD5100e94adb935b455dd47dad42437fc8c
SHA105bee8b542c9197b8802fd646c5d257bd4dcde9e
SHA25680ba1c9809d364418bb57300db2d69432463a4c79860c412370694440a954647
SHA512f80bb4331ff73126c0f2e79eefec96f6917a662e16b304ca371c56930836166976537908515bda9a0a828b33491278e9e8cd5585a0bef9bb29d60177a938139a
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
676KB
MD5c98ff14067e1dec3c0eca0f8a3380343
SHA199d5b0b0eeb9c057ced5da21ac2131bb17eac86d
SHA256e844d16e10ba1718230469265e26bcc7de04c1096e657250a3f28d6126559f07
SHA51274223d0f055a3b293ec4e948818a30895e9f1c039177ed1e94d954d72ec8422d4eb9b60ecbc84331ae94715c1b40c9623cbc29a549755545c7aaf6b864066c9d
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
1KB
MD5fa900de21fc89fc5907874d10c6c8fc3
SHA157917dab9feccc0ca85439ef2e1a084147ba4d86
SHA256c1a5095bac3e5799c40c7af24e0c2e6588d1ff36d3c58cfbf958d026b3d67b23
SHA512d771324eb5ae21551b7aea58e8fcf4a1e840fe56dba673288920b57787dde427be8b08d5b97ed5b3b15a2d2f63697c64eb5c28508347bcd278c2a46b2d9563da
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB