Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 02:07
General
-
Target
2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84.dll
-
Size
672KB
-
MD5
97176ef73c7fea0611f6188ad70f6b18
-
SHA1
b5e7852bd4a55d61670b6a89feac9c18a13763ff
-
SHA256
2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84
-
SHA512
44f957869dc757fba5ed83bac42d51fb28c942b13e3730c86e518dab1ad3311887013adaed70d213054c34cfd6815eff44e51f590e322c8b67e71c91e629bcc4
-
SSDEEP
6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\fzh\perfmon.exeC:\Users\Admin\AppData\Local\fzh\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\kblTNx\msra.exeC:\Users\Admin\AppData\Local\kblTNx\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\1xVfIB\Dxpserver.exeC:\Users\Admin\AppData\Local\1xVfIB\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
168KB
MD53eb98cff1c242167df5fdbc6441ce3c5
SHA1730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA2566d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
904B
MD54d1ddc2378817eff463d87ab801972f2
SHA104ef1c12c792754c8d33c37b6ebc08145f441998
SHA256bcb9d4de60cdb5b2efa11d6911047730c49546d523f76ccd23cb975acce32d93
SHA512644e88242ea927fea3cf7c8efe50f7b4dd7ad92449b759977edc0f23e15ce08caaeffe6dd66595738ed3a884c67a876885a2acd25a13137eb96ab7b59d88f9b9
-
Filesize
676KB
MD5115a968efe930affce21d995f3714699
SHA1d8cc0065a319bc4228b0ddf526bf384fd1691e56
SHA25610ba40c2e9f901c4c5b2fe5a1543fb6dd7ecf415ef1a7bc86e7c1d333f8ddfb2
SHA512bb2496949b45cea4f4a32155ab4106b39a27fe3302cd950324cf8dd6089951ab9b551330ce0b0890bad0ba524ede7d97375fbdadceae0a1754b099ff396c1e99
-
Filesize
676KB
MD552a4edff099246f415bc78d88abd43e3
SHA11511c3f8e3f3abfc056b58db0953038439acbb8f
SHA25653b0db2e6a0ac29a7be3d1f33d29f2c4f850177f2e190ca13bc943d1df1a1017
SHA512021aa8269f2b3e8cce0d88d548f886828113b115a254ff14d4ab07d356dd4dc619902b37186ec89a1af5968b82fe94ab41545422ff255851186255af5ba1e8ac
-
Filesize
676KB
MD512b57217539dd643d3dff93c3389de49
SHA17b066e5bfae4976f6cd51f2cca0df7e26120c551
SHA2561f945a3524332b10341ae152abe02e2e5b0c4a6e121fd213135bbbdb855bae34
SHA512794747ab23b3a627e8f629a9ea4be30d0df64429dddf1a4384f7a6b84be09ef62cf5568a51eb0c7ed363f0da5fbac9a12d56caab6308b63feebd0f3f7aefb8e8
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB