Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 02:07
General
-
Target
2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84.dll
-
Size
672KB
-
MD5
97176ef73c7fea0611f6188ad70f6b18
-
SHA1
b5e7852bd4a55d61670b6a89feac9c18a13763ff
-
SHA256
2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84
-
SHA512
44f957869dc757fba5ed83bac42d51fb28c942b13e3730c86e518dab1ad3311887013adaed70d213054c34cfd6815eff44e51f590e322c8b67e71c91e629bcc4
-
SSDEEP
6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2fdcb7115dec02a898b6b1d7fbe1804ee333309422550f5271851241e70d6d84.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\rbw\DeviceEnroller.exeC:\Users\Admin\AppData\Local\rbw\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\xzpL1O\OptionalFeatures.exeC:\Users\Admin\AppData\Local\xzpL1O\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Users\Admin\AppData\Local\R1gbqPuT6\ApplicationFrameHost.exeC:\Users\Admin\AppData\Local\R1gbqPuT6\ApplicationFrameHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD5d58a8a987a8dafad9dc32a548cc061e7
SHA1f79fc9e0ab066cad530b949c2153c532a5223156
SHA256cf58e424b86775e6f2354291052126a646f842fff811b730714dfbbd8ebc71a4
SHA51293df28b65af23a5f82124ba644e821614e2e2074c98dbb2bd7319d1dfe9e2179b9d660d7720913c79a8e7b2f8560440789ad5e170b9d94670589885060c14265
-
Filesize
676KB
MD5e362c3c58837e00a29988f0de11ed81e
SHA10d8f894272807b8636b3efb2d47781a400d1c2a4
SHA256a609ae46e1a6a672b3510406fb582e4fc93e084add06f76f2cecf83df23c6b57
SHA512be74196bcbd2e6d95948bbddfbcd3f17d3878c1662a9a67ad07998201bb3edb8ab681b9428b546d15ea2ff88921244673200c936094cc56461d6fb9a294d5fc5
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
676KB
MD5fd674faf381de2c40e8c4f81bd16e56e
SHA1d5b0eea16047aa9838b6ec27a232c43d5ec5c551
SHA2567ef73ec836fead7d10e79a9589e9e197d300b2030841fb2056c746c61ff62c27
SHA51219bf065e73b1426b0e1436d4e2fdb475d0831c6b6a4ae01df790fb55f8b70172d45a4ec7b2da0c322db382ebd154ed816fca7b4ec2aeb2d22b4ffd93494878c0
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
676KB
MD5c2bde736119454783bde2da06f699fce
SHA18260e3e7a2780494c8b93465b5dfc1b003f14956
SHA256b0886a1004d453d0acdec72827733428be9b55d3779727c2f708a506315c7d7d
SHA512201abb4c59a747fcde8445443f5c09f641dfc43d88eb613fee1e2f0bc7b32e5fa2b0d918674c740e08171f5a03bb29be4344d857d4abc943bedf8e0c9ca80ce7
-
Filesize
1KB
MD591780da3f1ef6085fb299d756745bd6d
SHA1bbfdc1b101a69676d870ba63ccc6b978d3302ca0
SHA256e550ea7f7df6ced59de02281152f4edd3bcb473f6e4cfe89baf6c66fb507ba79
SHA51245bdc1b5b013fd2649feca00fd70644991c423aa9eeac9d6de590d44f7faed2cabda66219fd91eb727c86c3e9a9b4e45618d69539cd42b84d8b7e1ec9385a4a4
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
28KB