Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 02:07
General
-
Target
9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd.dll
-
Size
672KB
-
MD5
08fc9ca5c852d1e0868b059d591464a9
-
SHA1
9735f7c6a437b5d19a9650aedb20210bae91fccf
-
SHA256
9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd
-
SHA512
e353c859df21732c32a6a206ab1be26525df105da216c83c0d4679bb8a3e3f2190654df037232497a04d02699897850c136f47e5428897d9151c49e1ccd7f717
-
SSDEEP
6144:Y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:YIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9dae682deb306e5c72d8beedc9eedf323b3521386e4aa10bb9b9d3f3094666fd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\LdsE\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\LdsE\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\PyLu\RdpSa.exeC:\Users\Admin\AppData\Local\PyLu\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\4TCzQzznQ\BdeUISrv.exeC:\Users\Admin\AppData\Local\4TCzQzznQ\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
676KB
MD56076a0059e225d28a1fdf08f9ab5afa9
SHA1f5aecbd08301ef61fabef398d7942fba940219d4
SHA256843cd4fc20e749c56fcfd76f5db71893b565de6e516bf104d2281a2acbd1af25
SHA5123d2ec45dd303925b440927b0f442cfb1e286dea193bf0e1225cbe8bba7edb1bc6cc9f7c92085be11e663369ed53cede5e9c61c788add6785e1884b4e84eaca68
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
676KB
MD5bd9e41e0eadf443b7824d5379faee6e7
SHA114deeb327cb0e9f0008e9929fd56cd0e6cb1aa21
SHA25689118eb629e6b5e50dc4034638858c67d9af8240ea2d8f920de26f0d50afed11
SHA51266e59b4c6556772671375340155c4f8632e9f2b16e5e1d944e53e19cc5c74c0abb7dcab12762b49c9e9f1072081a15105d30d2af9441230ac1c6c77195ad2692
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
680KB
MD56c7232056d0a6dd72043f4fa6ea434ed
SHA1d116e2907f2664ffb2ce44528978c51982ccd075
SHA2569aef30902f615e0c9c7f9aad1569d8447540a569505daaf7b7efca1639eea145
SHA512144794b05f0a2295e5ab437020302041fb87647af7af6794965f881f77471720cae93d116c07a4938a1be30bc5d4b2ae7cde518ce12f9b7de12c27a3cb572a46
-
Filesize
1KB
MD51bdac1d6060f62052e7e8a5088e5d889
SHA19d8f98286ae0b7b5c8b7a7d6320b6208327e41e9
SHA2566d907ab00fc8494610566851f697eea05ea5ffdfd63e922234aba02b03246192
SHA512b777f21ce12ad6448538b3d8fda4a8399324ea4d35207d5ff61288ad1c0645800baa35a2a8657138c75d90106178279dd71627a28f6981f062c8371c52cfcd53
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB