Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 04:15
General
-
Target
7b5abbc20d881379a184b6c2f29a1e70196b4dabdbfbebc60f439a83be323bb4.dll
-
Size
668KB
-
MD5
95c5f4396d2f989fa54fd09521fc2676
-
SHA1
7bf1a0ee837c77866dd7ea42eb0ddf060990fd81
-
SHA256
7b5abbc20d881379a184b6c2f29a1e70196b4dabdbfbebc60f439a83be323bb4
-
SHA512
1ce9ef6f4f5cc2d4ce245b0efc330d7e62dd0e4a8ad57570f25efb67364bb6ca5888ad9dcc1a41ee95d682aa0b4633971c6d83428cf307fa6ea6fd0692dc7494
-
SSDEEP
6144:v34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:vIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7b5abbc20d881379a184b6c2f29a1e70196b4dabdbfbebc60f439a83be323bb4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\SYjUxJDx\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\SYjUxJDx\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\yMeixB\PresentationHost.exeC:\Users\Admin\AppData\Local\yMeixB\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\M0VR\GamePanel.exeC:\Users\Admin\AppData\Local\M0VR\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
672KB
MD596ba192f0de25bbe8a04c507d3ae2ae0
SHA1c70ba59aa3c34274a0fe8ee1134640cde70b200e
SHA25608fdea35be7da14f4a2c56b43f1e5a7cbd62638637dd2ff480b3a13ea7f4ccf1
SHA512594c5124b34f013c86a0a21a35523744a8ab6b1eab4746c35763adcedd943a5e55ebc95bcd3569f559cf6c88c276fe9f693219798f8b08b538d7cd098c596480
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
672KB
MD533a3fec279fe16b6b9a422285c6ec5fb
SHA172c3c97b05ee825b7000617d83e29a644202a593
SHA256799f55caffab38db844d6c537b2fdf84b76f83cbc3b568bb0bd02f9b2f76565d
SHA5122ed01836886927279cddd58bbf900c52220a2271242a91d50c289c831637ee1b0555493c4016ade48d508e341540d24c6d96fd932ff74cfcafa0f546a4aa012d
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
672KB
MD58c6f3359c0b229ae844d261b4d801964
SHA134515ae7b3360be99aba0f756141fc721197bfa9
SHA256b5d6fcb7167774c21b0b4053a25a789973f145f0d30c926a4287afbc56d270ec
SHA51245f180228d3eff356a1243a59e70a0c3603b63989b18735a00071f0e54a8628ef2ee3265e1e07f7add2950f837118859a82468d8bd247aba7db819b7c6c12ca6
-
Filesize
1KB
MD50d6e3577e058d33a0c83aa8abc44f1f6
SHA10871b01e4a3909ded0502d65ec49cba76db73742
SHA256dfa287903997770bdedc736ef52a872f39033a3aef08623e67c24bbe68ce21cf
SHA512c4905fcbd09afa1c8bcd5b35c0b7adfbc291098ffad345cb6071a6d17d00d9c3a08e10c1f72c3d932bd0b8d28bcd73eef04fb0e3234b2c1a638d7dd53c73588c
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB