Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 04:15
General
-
Target
659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf.dll
-
Size
944KB
-
MD5
a4804bb1aba480dec5d7b54e9a82747b
-
SHA1
69f96371c589b596531fc402aabe99165472904d
-
SHA256
659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf
-
SHA512
a2f4980109bd4109a61cc618c5a09772291286c6d5ceefaa180b340a4f57fb49cd8bdfb510710c5293dbe2d2031acfe7575f9b4e42d019078bd2d007058ef37c
-
SSDEEP
6144:j34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTR:jIKp/UWCZdCDh2IZDwAFRpR6AuvS0K
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\659fb5a890e7be6cbfe2a20042a83f9032907ea12a549de3aab9c0c79211beaf.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\qpCcK1\psr.exeC:\Users\Admin\AppData\Local\qpCcK1\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\1sombeXF\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\1sombeXF\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\o3CdxM6\CustomShellHost.exeC:\Users\Admin\AppData\Local\o3CdxM6\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.2MB
MD536dbed5af12723ef5e9fa86125da07a7
SHA1384c4ce7d2d7da24fe893a2ae5a9f8a3182242f3
SHA2562fb778f70bdce876e2f4f6e066896b3898c240d98c3f381dcf9042ad3ba23521
SHA5125d418d95b801a0d0360d6af4490d0ec9dc8f9e48b49610cd1b32798e0c0bdce3311b14b12752be1579ab51af105b1c2af01a58e93239dfa275cf74d1d2eb924f
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
948KB
MD599cf674d173906bf53f74cd5979f3038
SHA1142771ee9b4ab5d9008a73d2a86f2681c53e5685
SHA256af110655a586284a05321cff872cc9ec885e3dd1d3aa68407e49d1a4a209004c
SHA512a6e6ae3c44454cd89b218c4d1f28aedab6b8f8c1873607ab4961bff6c1ad14338291b1be84873855a0904bf017485e30e2b30254476223bd82214bb404f66d04
-
Filesize
948KB
MD5d29049fd05afdde14668b58a2def29be
SHA1e56a414dcce38767cbd5bf21b186d7dd5dba83bb
SHA256a3d8959c9ee7d90ffc8a543b9461e0b7d6181be5657985171c453e4f99267dd2
SHA51219c04e38d7578151fba15a6f0ee4657547543272f74ce73d9b0b933c2f20973b2377a6f0d8ba0d32a003e07f440ca9d36424ce17f262ab9249cd121abc0ef074
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
1KB
MD5deefb862e8c29869f0bc7d1e80d767f6
SHA116c4bf736a016a461b2a4b747976840f583581b8
SHA25633fffd9e8600ce80b78f144f323c499eaf55c91c4323094f4ce49675b498fd3e
SHA5122748258d9c6723dc64fb88e90a9687550a6178935988a764d03efc111612534e9efbe615ed7c54ba4b62d6ffa071e7e4f69a89d9443e73cbf4e1c373321a77b0
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
948KB