Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92.dll
-
Size
948KB
-
MD5
c3da5425420b0f94aa1a58c38ef6d14d
-
SHA1
891965f46beafca8d84b87e9aa815d8d7b8171fd
-
SHA256
43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92
-
SHA512
1ebc2ca75e6354edd72ef76991569565199267a472756077166deed6fa6b22e46d5df3546910c78b4b80b54e0e98f6eb5142e254feffae2026f46773ac687dee
-
SSDEEP
6144:D34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:DIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\43508d520d7e2071ccd08862888e65cb9ae724268835584aec28c355f22f1d92.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\GamePanel.exeC:\Windows\system32\GamePanel.exe1⤵
-
C:\Users\Admin\AppData\Local\rSZ3q\GamePanel.exeC:\Users\Admin\AppData\Local\rSZ3q\GamePanel.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\dCpW\osk.exeC:\Users\Admin\AppData\Local\dCpW\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\FkpG5\mspaint.exeC:\Users\Admin\AppData\Local\FkpG5\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
MD5f4c23f53bc9aa8f3202499cd7d14c46d
SHA1a590c0c636c0aabc883a303cab47b4caec1a2bcf
SHA256401dfd1886c2daad1314c7adf0cdab26543320e635af5ebc5dfca480b10ed10b
SHA512fd7716330730303a0eee3b441a33a6be020b997939bb99ccec106b8d7ac77c887dc4004cce15cc3a20678b2fb92787f5ed9542f497c09b447e47fbe9c2adc61f
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
952KB
MD50cf57382c69f1bf2e50d0e28b9c57a03
SHA153da1c1bc494d4a4fd3a56b3a5e3774ebba8e997
SHA2567cf2a10df00c9508b5932fb3abbd3f1535f1bf22a5bb3f6da3ded05c835bae6a
SHA51280e47a1689eaa47febccf12bf746d0ffd5b76f812425d1c770ba45f85d3c658d15cfd41063ec97665d111ed05618114c68fe17537166aa9f2b820f79dd6fda38
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
1.2MB
MD5266f6a62c16f6a889218800762b137be
SHA131b9bd85a37bf0cbb38a1c30147b83671458fa72
SHA25671f8f11f26f3a7c1498373f20f0f4cc960513d0383fe24906eeb1bc9678beecd
SHA512b21d9b0656ab6bd3b158922722a332f07096ddd4215c802776c5807c9cf6ece40082dd986ea6867bdc8d22878ce035a5c8dfcc26cfae94aeee059701b6bf1e68
-
Filesize
952KB
MD5e6241a6dde5d5649e7a3baa249d87c8a
SHA1f2189ca3b0cc84abcd07f387617fdebb0f0d2c4c
SHA25656442be66363c6e50aad5a9b706ea3367b5cba4603697538895725c22244db44
SHA512c4a00edb531b0de9499a71a288b45fe0c3720445acfe892d72e06ccd07104d3c4cf524040dfa5b442d320d27147beab81cb3c58282cb5b80f0e6dc392be62e1a
-
Filesize
1KB
MD54af66c9a396b87f9fe93960d152acbeb
SHA17722cb2cbb50f1a2dcb21f9f63b893a8dd3ad9ae
SHA256e41a4d8fbc9432c5a9582854d841e269a56137a941c251cb94c223370761a2eb
SHA512ca788c9dd72ddafc43eb79fd3b1a629a0752689af3fa155fbf4084da7cf7c7a202048b801f2c6d6bc6ae874e34b161842d3b3f3a371cee25ec5ddf865a986264
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
948KB
-
Filesize
64KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
4KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB