Analysis
-
max time kernel
149s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18-10-2024 02:07
General
-
Target
96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9.dll
-
Size
672KB
-
MD5
f4ad23ec7d76d48355a204d4cca86bb9
-
SHA1
21cc90073ea6b2e99f535272e4ec2127c6dfd4c3
-
SHA256
96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9
-
SHA512
bdf9ff9cea9d581d4f81524e720985ff82f52ed10267410c43cbeeae018afb2b5b0708d7666393df02284e08736060e124beba414de4a5648a91f6c952f3ab7a
-
SSDEEP
6144:U34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:UIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\96245ac3afbbd284ab0a250ef29178ad97dbaa475fe1f7231636c29bdbd1a6c9.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\GFpHvA2\rdpinit.exeC:\Users\Admin\AppData\Local\GFpHvA2\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\0TAA\vmicsvc.exeC:\Users\Admin\AppData\Local\0TAA\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rekeywiz.exeC:\Windows\system32\rekeywiz.exe1⤵
-
C:\Users\Admin\AppData\Local\dbS\rekeywiz.exeC:\Users\Admin\AppData\Local\dbS\rekeywiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5e0d5e06927bfab53305c1541666bd9c2
SHA12b592b57e22549d9127d760e78a4a2bef57f5f56
SHA256c195dce5c2b67248680798d35b98fc6eb5811409a06fb29fa09f347a9bfef588
SHA5126037a58b3119ae34e3f09889b1a9e5a438ddfc3980ea320a1f468b0f15a66c84f2a8e56a65d96873635b1f8ae3c465a4484552b9751d917a07ad2acf4900d835
-
Filesize
67KB
MD5767c75767b00ccfd41a547bb7b2adfff
SHA191890853a5476def402910e6507417d400c0d3cb
SHA256bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395
SHA512f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9
-
Filesize
676KB
MD5f7fb63ce79e8b39900d8f00a21c1937c
SHA1f9941710af8c122c75da08e9daa57bf4bb16d208
SHA256c0bd1dd7604fd1200cc9f21e4bbb77364f15e84ff6c371f71248da7a0bd9f706
SHA512b3274557b3ce549ecf3f6edf6f2b612d703a39b9d5fc7926817ce7a4a0278ce1792a77a4c5a8fb3fd65763337e0961d62552d2aa7320092419d178d9c28cc98b
-
Filesize
1KB
MD538041e2838f8248e5737dc23248f2c8d
SHA11edae4d8a42760681c16677ac2299e6ccefb64cc
SHA256083007119f8faa79efb9a4e2ee6127872cd2f349d7185818034ac381b252f754
SHA512a1ecb154023320122f0766049200572ccd59dce042ad7cd9b96c671acad1da8e22c18dc95c3b5643e262339c63b34342b7d07a1500959a22da2bae5031e5446d
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
676KB
MD5b73705883ae6516186b2525952e1f4d8
SHA1320a71b5358f1fa82bf9bf3d1c24e3883e9f3ef7
SHA25635dca974867f8bcdf5b5ce87e1c0f16e7066201da965d3071f68b150576fb1ec
SHA512a8d2a998f51cbd4e1703050e4f1ab3b11e5270b7650e62f652efd15e592bbf26ac64d750919bd26cadfe6d52db8ead9d89514715d7141e677bed85a8e0fed21f
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB