Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 03:16
General
-
Target
75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d.dll
-
Size
664KB
-
MD5
5f6c31f53f65a1fdb86734c3f9ee7840
-
SHA1
a8c5aeb8b426258e84fb7b4bd181f85db18405ae
-
SHA256
75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d
-
SHA512
a1713364329e883b9a62409ce721ce7fbc929814e196c8eb18a3bf121cf2eea83d875869d1c8702ef7f9888e4f11659201132554d0101ecf6d0d89592025d242
-
SSDEEP
6144:y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTg:yIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\uwmA\unregmp2.exeC:\Users\Admin\AppData\Local\uwmA\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\h8G8\BitLockerWizard.exeC:\Users\Admin\AppData\Local\h8G8\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\0KqLVHBH\perfmon.exeC:\Users\Admin\AppData\Local\0KqLVHBH\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD56ee6432c2a9a0727a8dee618e4b79c58
SHA152eb879b159345421c1e69113fb7c2c5741ad2db
SHA256e1fb2894c534949a2b941849e15d3ee4fe5b0203bb2d5936e9628d2f6a01fbf8
SHA51265de6ff18bfbc34139071aeb5dfdfb532e970e5a49914ab42ca74296ba9594591b09a156f522c70351d371d32653c6823c3c4f2d9f80d572e1c0e173a3deea93
-
Filesize
668KB
MD54faafac550bb4d2c2bf05ea94f273a3b
SHA1dbe267d4c7aad28a91350708c3fb3ec013a72611
SHA2563dbfb3ff0d3e57a6a3616644106625e3c9ccf903b7ae2d52baa4e3ac27a73674
SHA512f8c3da74c2ae8fbe767d788c7e2f3d0265d076b46c8e04647ac197eb14be43380db77c35c2d673d6d166d90e73d0bb039b095d130540a342cd8b5db880878656
-
Filesize
668KB
MD595ef7b7235925abe6876738c649900ad
SHA104629bc5b1a6d4d436506664b92e41bef3158efd
SHA256351c84be50d9e9ffb030c24a7d6cb2cc6923ed25ece536c3f11f2e0f1a97883f
SHA51220bade1b45867527ccb1430826feae9eb305dae2984770b2667672f32a3093ce70b5e37c576f3c60247f6a057fbecfb57e788f12bdcd3b31edfc46a864c8bf5b
-
Filesize
998B
MD5b655f1db02cba43057bc83702dcf5dac
SHA13b7f747800936e2a816834529e04085a1d47d6ba
SHA25609d6e79a4ce109452a0d1bde4c4964190a053a865a1f2d62fa34c9879741c7f3
SHA5126ce2b036decd5b527dc06475ffdb0431c0f13fb81539e978c4ecc2b527a9464b20d75a74f05bae875e3d96e60c28a3788b136881977fa26c23a1774e01452cfe
-
Filesize
168KB
MD53eb98cff1c242167df5fdbc6441ce3c5
SHA1730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA2566d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35
-
Filesize
98KB
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB