Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 04:15
General
-
Target
659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf.dll
-
Size
944KB
-
MD5
a4804bb1aba480dec5d7b54e9a82747b
-
SHA1
69f96371c589b596531fc402aabe99165472904d
-
SHA256
659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf
-
SHA512
a2f4980109bd4109a61cc618c5a09772291286c6d5ceefaa180b340a4f57fb49cd8bdfb510710c5293dbe2d2031acfe7575f9b4e42d019078bd2d007058ef37c
-
SSDEEP
6144:j34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTR:jIKp/UWCZdCDh2IZDwAFRpR6AuvS0K
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\fH3GXWe\sethc.exeC:\Users\Admin\AppData\Local\fH3GXWe\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\AMwE\sethc.exeC:\Users\Admin\AppData\Local\AMwE\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\aWvm0\UI0Detect.exeC:\Users\Admin\AppData\Local\aWvm0\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD519228c7a0cfb6479694ac7a213420106
SHA1361029aa4565757df4c4064219e2d970d2d23f70
SHA25619c1379503f88a2ea36a418a2a735ba8572a36e7265b73e287037ffaf0c25423
SHA5121b2c41573d5a56b6f683e3817f36c5ab07e42214b0caada2cae9d4970278e6368ab9651665ee13609222a23188eb15b7a23d2ed6f8d4a8a0c186cbb59bb680ed
-
Filesize
948KB
MD5b06ed2579fcc7fdea2437a7f9772c054
SHA11ff4e8fd11d7ef0a709855d3b73eb657ea86caaf
SHA256a5426d13ad03d6e2ccb8e4a56e78ba19a923d8c5d85983350891527b9cf7b25d
SHA512c52687490c315cbdc0e754a4151af6c8c7f1db5479866e5906cd73618e0e0db4e74a45e50ae5d2eaf2aecdfa82dda503d4fe5836aaa1ab473c7d9f5c9bfef93e
-
Filesize
948KB
MD5db0ffd67e2bb917eb87118fe57e0a0f4
SHA1baa67050b6a388636a2eadaf9ef7d82b449e5d94
SHA25673c0e9dab31addca003fc770c22213af63c2127b136ecf886c9be867b38ffce9
SHA512b15c12eca7e62b851d761e34f912cc59003d5850ccbb86d7c549a7b5de90494990f72e0f03e9673f7ed6dc30d64e07f943a7e883b53d887d7ea6c40a90d74153
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
1KB
MD5c343bd9d2528f8b8173eb0d1b33e951f
SHA1386500d2ec86271dd4383c4808585e052f9e3d73
SHA2560fdbdc14a41bece073de018bda1bf98935b9730c1384b3f4ec5c5673ec6fad5f
SHA51251f7f709ed0552a373069ca039ec79d641752a9bc26326c1da471501f29b6f73dbb14510f9be8453a2c876b0e4351e4ec753a6e4def0cd3e088d25349ecf979d
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
8KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
28KB