Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92.dll
-
Size
948KB
-
MD5
c3da5425420b0f94aa1a58c38ef6d14d
-
SHA1
891965f46beafca8d84b87e9aa815d8d7b8171fd
-
SHA256
43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92
-
SHA512
1ebc2ca75e6354edd72ef76991569565199267a472756077166deed6fa6b22e46d5df3546910c78b4b80b54e0e98f6eb5142e254feffae2026f46773ac687dee
-
SSDEEP
6144:D34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:DIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\jx8oP1J\p2phost.exeC:\Users\Admin\AppData\Local\jx8oP1J\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\CwCidNoNM\mstsc.exeC:\Users\Admin\AppData\Local\CwCidNoNM\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\mm4N\ComputerDefaults.exeC:\Users\Admin\AppData\Local\mm4N\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5ee5f893aaa7fe3f85696d7310c45c433
SHA1e4a2eefc1cf8cc2392b59660ee6645a6c0209461
SHA2567ecd6aec50f37a1ce1c3e87414f5f4db29e96c480e996ebdf8fcb21da7365a59
SHA5121f1cf3e22f60b490e4270c53ea38a19ca9f86b7c41daea8f8ac860666df6da7fdd441e3b15e98e2350cb22e833ca39cd338ee06aca52124184b45d46001dff7b
-
Filesize
952KB
MD59b554a8736724ed86f187771c9962fa8
SHA158abecc99678d7479ad3256ed0e975e1ca6eb349
SHA256dfdcb7d5a52b7b1d9129ef6f7426373ad667714a2596d44e99a1f3d666affd01
SHA512179cbb51200773e920c3fb03c05fb03ceccc2877dc4691f95cf35b830528d329d04aeea51b84796ea7c13007fcfd4a143e4f7c6a346da9fd0b6ccb8f52c40170
-
Filesize
1KB
MD5842f1bcc1e8577e74f0df10297401e7d
SHA1e088a75e6d53b89a18a7320de472cc34266e3fb9
SHA2564e386f34b9d57d647d9eecefff72b6a992f8820e8e53e36103f15e6f44674c0e
SHA51262012ec1a0e66c3324f8e57574a4da5814b0dc5d059fd066b231c952acdd0dcc74f19434f31f060794cb89aed8f1cdea02b0f704f581bd74779df25907a6da5e
-
Filesize
952KB
MD52b2bb87c0e611f2bca267ea5fb4f12fe
SHA1d8b6401c0ec7cc27b12e50fbf5e1475229a0c2a6
SHA2566e9a2a7ad8e2d75a3b7c2a3e43413f06be604774c958c6cd8273934d58d18e99
SHA512b80e3680f6e336c70979267a9e9eed7697ed37e1dd239c28bcfa35f3bb6bfe9a0a94029c4c11c07f9e1f8d0be2b3638300b84909498909e7074fd1c1f51afefe
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
948KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB