Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 02:07
General
-
Target
9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd.dll
-
Size
672KB
-
MD5
08fc9ca5c852d1e0868b059d591464a9
-
SHA1
9735f7c6a437b5d19a9650aedb20210bae91fccf
-
SHA256
9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd
-
SHA512
e353c859df21732c32a6a206ab1be26525df105da216c83c0d4679bb8a3e3f2190654df037232497a04d02699897850c136f47e5428897d9151c49e1ccd7f717
-
SSDEEP
6144:Y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:YIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\3qEFKJBn3\MpSigStub.exeC:\Users\Admin\AppData\Local\3qEFKJBn3\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\wNvl\dialer.exeC:\Users\Admin\AppData\Local\wNvl\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\X2hb\UI0Detect.exeC:\Users\Admin\AppData\Local\X2hb\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
676KB
MD568bbc2ef30240e15783d02f4a943a877
SHA1b56a407f4840a4161fae3e5046dd163b1d5f330b
SHA25658be87bd59234211f9d29e6cfbf2382ef6602f13a66a21d49e20eba96f457427
SHA512903737a7ca81aa9d6731379886cd19ddaacdacb54729cc052f8b233c2d4119d9d14c550ac37b62b9d1715738aecf5519ebebdfc1b685f64668f61631d2843dbe
-
Filesize
676KB
MD53eaadd8994c0271f960407061061392f
SHA1686bbfc4caa0bad6d12dad6378bb3eabc1137e90
SHA25649cee862cfe0df61341287bd830e8f472200c01559c058c5d1988f4b2fae98cf
SHA512747034277686019547703d80f60ab63706482322e17d0d2bbb6f2644f087babdd40aa0140f8045618e8831f5cd4fad762ca7dc0239e82a239eda03d037cecc8e
-
Filesize
680KB
MD5e59dc09a74d47039479f43426b97571e
SHA18704d0073adf0cec8c9892d956666f86f58a9f31
SHA2564ff2412533b4d25ccbd08f6ae3c596af28bd710a3bc09b6a7ec0400708133ce5
SHA512dace077b72b154ed4344ce11cd1a2d5099aa4014bf0a326a94d75f203ce32a0eb6bd8ba7f5a98384b6ea60f0ac5d1297bc742d7f3c46142251f151a4d94d5f96
-
Filesize
1022B
MD50bf4fcbcff42e82ca8af6ef00a7d277e
SHA1a7d46f6a2f755b01a3a9505fed0567775a056b97
SHA25673077c2363b7cb5fa4989029ec87ac54236ab931cde8e43b98d3556c7f00b532
SHA51234fdd36044047976d5cf35b7d1f18998f3b1832540938181fb1a340f7f36c33279db0c560050bb9dc41acd41b1f9500cfac830a33dfb465a90c3504ff487ec55
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB