Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
18/10/2024, 03:14
General
-
Target
6e00c66fc1b25613485d0e05cf9ba5df425c26529072dc9cf040ee5061b24d2e.dll
-
Size
668KB
-
MD5
c3d17f1d13f9abf90498dd0124f5b116
-
SHA1
602a31d2909146fa0046ee1edf1c3a79ffb1a8f1
-
SHA256
6e00c66fc1b25613485d0e05cf9ba5df425c26529072dc9cf040ee5061b24d2e
-
SHA512
f4007128d563482dd03f34c720d3058668313a8613962d333052656b24b6735a5727dd1a49d9a1a5af9cef0381c77eb527fb366d444177c445f9f4e4fd1c4f12
-
SSDEEP
6144:A34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:AIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6e00c66fc1b25613485d0e05cf9ba5df425c26529072dc9cf040ee5061b24d2e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\lUns\wextract.exeC:\Users\Admin\AppData\Local\lUns\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\h3VhbVzf\spinstall.exeC:\Users\Admin\AppData\Local\h3VhbVzf\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\tp37\consent.exeC:\Users\Admin\AppData\Local\tp37\consent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5182682c5209c8e138b67a28bb132d83c
SHA18165f4af78267835cbd5419a17243575126b2ec2
SHA256fd7464a876b2f2f6e5ff03f4ac897e4d6e4c8dc0252a274539e4546d3fc0e797
SHA512c4fb55bdf918407fcb97631f2544732a82ce6ab85981c304e96c44d207f1432ec83690eb7a1dc3f5b9240874211bf9e1a41b20f5ec9329359f280d7735619065
-
Filesize
672KB
MD55235540949eac7e2a0f6fb563f170f8c
SHA12bda53f8a65c5ed252cc3a86ae97da74b0623865
SHA25675a77e29ba3c74940ac12bbf8f8950542e4676a3b042848ef35032d79e7628f6
SHA5120e022441868169edbda4476abf4562d1a16ee6c9b07935c711e96466f0c2403e4db5e3d3df803887b70e16c4902cd6a127d483e9923b9e648cabc42939c2bcc7
-
Filesize
676KB
MD5c6164077dc1aeff059993dd453df05b2
SHA174cf3384439ac6759178c99b6b4b7dc6eca27096
SHA256350c3fabb62505766243dfffb6fef5801521f24ff55fae9e036112d568976c82
SHA512821b43278aa6435b9e856ee445c9fe4d9f6cb2939c1ee145039fe3494dbca063d3c92348a6dc596c721cc758c8888968ee98053f0392a2405fccae113e7543c1
-
Filesize
1KB
MD58ac31485ebc82c5e0c257d29f67b814d
SHA168772a197133267093b8d1350e3f5c1166b49585
SHA25652a54cb1f091db76341703de6a9d47503c539a9d438c7379abe6cabe189b68ee
SHA512c769dae0756d6b1151663bfbd190c138bb1c0a2c911de6ab09ff6d2b4f41be8af0212ec1d31d54d62bad86f1e82d150018f31fed0e901d5d06c4353f1bd9753e
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
140KB
MD51ea6500c25a80e8bdb65099c509af993
SHA16a090ef561feb4ae1c6794de5b19c5e893c4aafc
SHA25699123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2
SHA512b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb
-
Filesize
109KB
MD50b5511674394666e9d221f8681b2c2e6
SHA16e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA256ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
SHA51200d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB