Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 04:17
General
-
Target
94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312.dll
-
Size
664KB
-
MD5
ce92fb27287b8d8da3b53825faebe282
-
SHA1
b0b3a97dcfecb6a25ad52cfca9a9f8708eaa3a76
-
SHA256
94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312
-
SHA512
27f0d045d02c93cc1ebc5e5ab22716fa48d02d00f02445b3e215c980e01ef1d688cbbd732924113fdb691ec076fefa0ee8f5124b4164544168397b6129a8f215
-
SSDEEP
6144:S34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:SIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 5 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\94a90a4eb25abcbbac0c023c3736473b5a29df02f1a702ca86d037b5ca244312.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\XkIu\dwm.exeC:\Users\Admin\AppData\Local\XkIu\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\ahZb\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\ahZb\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\iDF78A\CustomShellHost.exeC:\Users\Admin\AppData\Local\iDF78A\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD55c27608411832c5b39ba04e33d53536c
SHA1f92f8b7439ce1de4c297046ed1d3ff9f20bc97af
SHA2560ac827c9e35cdaa492ddd435079415805dcc276352112b040bcd34ef122cf565
SHA5121fa25eabc08dff9ea25dfa7da310a677927c6344b76815696b0483f8860fa1469820ff15d88a78ed32f712d03003631d9aceaf9c9851de5dd40c1fc2a7bc1309
-
Filesize
668KB
MD58939ed43dfa7315274772f171010e849
SHA1b86fe16a0028d7f41896ba94a363143cba23ccb1
SHA25680895cb9961fc8a6f374bb7382f05c758e9f5ca233ac32864fe4235f1b271afd
SHA5129007c7b07328a6037d982f8c09408c543f29e6d0c6a6cea166850ecd778d5d8259d9cd55b955d1e40469d195243c537321b0e488801aaf9d88840575c4bf874d
-
Filesize
668KB
MD5a8ea455f6fb4af64e1da0eb0d1e539ee
SHA1b2c59685ba38abd0e56b42c5b7a7a0b0e0575600
SHA256df73c43a8d8f2499de2d4704a811b526d9b66fc6fd682ec50611a2d8cdd2f9e4
SHA51265b63063df8ad867ee37f61d6bcb6824da5dba3e76f5c57f4ade3931f00979f78e07eabbe4d20b753f248a307a7e1119f530f372f33eb90646dc9664074cc9df
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
835KB
MD570400e78b71bc8efdd063570428ae531
SHA1cd86ecd008914fdd0389ac2dc00fe92d87746096
SHA25691333f3282a2420359ae9d3adf537688741d21e964f021e2b152ab293447f289
SHA51253005dda237fb23af79f54779c74a09835ad4cad3ca7b9dcec80e3793a60dd262f45b910bef96ab9c8e69d0c6990fea6ca5fee85d7f8425db523ae658372959e
-
Filesize
668KB
MD565ed848bdc9dd7e9d02b58cd906545a9
SHA171b216cebfc01a34e85a48d9db5577f80a023efe
SHA256878e13ef0e4a0cfdd8fe4d3672b0de521e7143abe580ccd12ad8d687c49cfe31
SHA512c95b0925f0fd5eae81f79bc8ed23dfbf9dec98744a87147f8c20f2dc31bb9022ac5b056fe45b85e3a889f09cb31af7ec11e9f64bbcd19a66a270651668749f04
-
Filesize
1KB
MD56dae35660fa60ea9d75f2ec387be9f6a
SHA17068db6768af6b09a679430f94f8b9dee543d3f1
SHA256905bff3b913311ad6a5904c3e4b853e90eb1fbcd6f84027637d2280f79ba93d7
SHA5120ac1b96de1851946d8b3238151f54dedfe3dc0c7f25d9e66448ea6b0750278d31e6ed71cbfe36d5dfd92c114b127e71aef7c82d3c8d9007fcc3b73b583efddb6
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
664KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB