Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 03:16
General
-
Target
75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d.dll
-
Size
664KB
-
MD5
5f6c31f53f65a1fdb86734c3f9ee7840
-
SHA1
a8c5aeb8b426258e84fb7b4bd181f85db18405ae
-
SHA256
75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d
-
SHA512
a1713364329e883b9a62409ce721ce7fbc929814e196c8eb18a3bf121cf2eea83d875869d1c8702ef7f9888e4f11659201132554d0101ecf6d0d89592025d242
-
SSDEEP
6144:y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTg:yIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 20 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\75744da9a671242b908e36a14db2b512b454f506e6eee9e77da3bec1e7225f7d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\OYAJx92w4\SppExtComObj.ExeC:\Users\Admin\AppData\Local\OYAJx92w4\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\ei1\isoburn.exeC:\Users\Admin\AppData\Local\ei1\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\ZtYqhO\shrpubw.exeC:\Users\Admin\AppData\Local\ZtYqhO\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD5cb11afd002ff1574045cf9eb6fda9953
SHA1adc31e36c364a11e15f32e0af3f06b4a34cf9fe2
SHA2561ff38bb7901198e26dd3d4ab4d82afafa2a658ff50e9ff881a6b8f233057c0ff
SHA51285b6592c65eeb381f517a98bfeef7ee81ed078bab1a03919e2bfa44f1acfd16c9ff9fe849824021fe2bef98eebd40c916888cbe17ca8530b4db33cde437bfa60
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
668KB
MD5ec4259db1c6819a35b9d9e5134daad21
SHA1ebdb61c7bc858cec04961fa9130c17a39211a86a
SHA25640815b4d1bc88727ef88005c0f1281a5b7db8e69858aed6821646b1fb2e2ede9
SHA51275a7da35758bb6d90a5b610e28917c1f1f51fe3a93f89b4856b998eccfe2b62dbb376d3b2f89e3f7fc70dde6f366e45e49b7998052b33c82d3b9965be6536fed
-
Filesize
59KB
MD59910d5c62428ec5f92b04abf9428eec9
SHA105f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b
SHA2566b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e
SHA51201be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb
-
Filesize
668KB
MD542ec802b69b71ac4d56cbe9f94cbb91d
SHA186ba8c0673eb5271dcd79d9ebc7c76b89ff6f1b8
SHA2561ba8256511e585fd79f8f833b2eea7a28ed96c47d029ba01b40d6b1494213ed5
SHA512fa7bef5fdfdc4807e575487d71e84df321bbf1cc0208a9ac169b16fee4f93928b2e1496db509c86c34b343e0c30206b497fcce84d390cf908ffcd615b5e71de7
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1KB
MD514a7107b8cdca0ec7cd89fe4bb0ee0f8
SHA12d5a58c5a5ec9d70fe57a38c75334eb1841c535f
SHA256979b6359f1090db16630d1f43d843669b773063839dd8e391072ca34b33cd7c7
SHA5129c5fabbe9d4a0c3d7db2aede23727f116e1e18031b6872bd4d45f0179402cdc54ae7c2105fc14e2ec21b485954155852a857fa8ca7a0c8d09c37079bd16b6211
-
Filesize
668KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB