Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 04:17
General
-
Target
94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312.dll
-
Size
664KB
-
MD5
ce92fb27287b8d8da3b53825faebe282
-
SHA1
b0b3a97dcfecb6a25ad52cfca9a9f8708eaa3a76
-
SHA256
94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312
-
SHA512
27f0d045d02c93cc1ebc5e5ab22716fa48d02d00f02445b3e215c980e01ef1d688cbbd732924113fdb691ec076fefa0ee8f5124b4164544168397b6129a8f215
-
SSDEEP
6144:S34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:SIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\AMSXU\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\AMSXU\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\7srFoWLSy\isoburn.exeC:\Users\Admin\AppData\Local\7srFoWLSy\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\fXp\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\fXp\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD5778bc8dae30ebbefaaaba9d8c6bad52f
SHA1df2511e0bc985da76e0c9c2be19a34801bdc08b3
SHA256ef7d38fa2e2f7d9a1edcb8c625500d6fe30cd00a9eda019297303df9cd399441
SHA512ba8e4a1cb25c72c196a040c39e68909f2724431bec4ffda0d9e37123d9091d8b0d9e4ffb2e3e042746dbed58a95045eb65776e08f89299322eec2f791f79637e
-
Filesize
668KB
MD5476cc868355015b42780ddec7b6ef9a6
SHA1209da7b215b01ea0b30db4f790fcdeaa31c967ec
SHA25687c746af7f9fec5bd7d78e46b0134c52deb4cb2e44d315a469ee92befd7a99cb
SHA512e6b1bced56499ac4fdae648416316bab06e4948346d4e5d622fca754c8381e353ad673948ecbdcb89d8a8440e8d5cb5f3860dac3391526fdf68338917568323b
-
Filesize
668KB
MD5c699b9d6f5cb23bde8d871af2943e8fb
SHA1323a813f7cc0311d7cef1cabba53c791e7815c06
SHA256671674786a725cd8daedee31401fbf661432018a535682cb13b02fc6c64aa448
SHA512c4a119d54390bdce5e22daeda5d38de65532c3504399ed69b823b095391a233e6b458219e156ab40a394adc243de5f43552917f9421de3001e13ef21e0838410
-
Filesize
1KB
MD560023de9d7307cae735533964bf6de3b
SHA13741240798d44daad4f1289c17e211a004d84daf
SHA256a422f3f1b80e0544ecc3a80f2b776e7b6cc71561678ce691deecaaef0b72ce32
SHA512d5de6382427ff3d71e8ebbb7684c0395a660e569b4db4195b81efcd2b837f0af04551b5b47d1863d0984a91bcb7dd466a79ae8884ddafcf1a19b2213d43e47d4
-
Filesize
89KB
MD5f8051f06e1c4aa3f2efe4402af5919b1
SHA1bbcf3711501dfb22b04b1a6f356d95a6d5998790
SHA25650dcb4be409f50d26c0fc32dd9cdbf96bff4e19bf624221cb566ebeb3e09ce1a
SHA5125f664d937abe4426ee7e0d8491a395f9ef4ffe7a51dba05b54b7ba27e80c9be37833400911c5878d3dec659f4fa1579ec8ba4cfc485fb2ce24dd37c321006daa
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB