Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
5a9312f37fc4f6e40e1cf12c15df2a7d84199ac4d594831db9f6ca1c4a6cbfab.dll
-
Size
668KB
-
MD5
f640bf21877302ba5a105a1cc52c4aef
-
SHA1
7f84c86e274bed6a64be7123cb15f4e1fc477ff6
-
SHA256
5a9312f37fc4f6e40e1cf12c15df2a7d84199ac4d594831db9f6ca1c4a6cbfab
-
SHA512
d0f670cd9a926c674bfb926b6d080ecc8e0b3d6f2350567cb0d8ff56a15c53b461064026f5b9604afbab6035b4aed7786c66d3ef529fa789708910c1d6acc3fd
-
SSDEEP
6144:f34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuT9:fIKp/UWCZdCDh2IZDwAFRpR6Auz1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a9312f37fc4f6e40e1cf12c15df2a7d84199ac4d594831db9f6ca1c4a6cbfab.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\gDAQ6\sigverif.exeC:\Users\Admin\AppData\Local\gDAQ6\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\U5I\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\U5I\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\PMcndVV\msconfig.exeC:\Users\Admin\AppData\Local\PMcndVV\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD55c8cee3633c52170ed02e8f5404aec20
SHA10b676d48b0ad7246738617acf280a6aa8756e4b0
SHA2567b3d8f0f33ddde6f7b3da2f620939342356f9f98b8468923123ab6ef4dc23e53
SHA5126f42710a14c871aecd14ffa7a50d08e94dfdfb1a18c89596491ff6162862d74a15cd940fca91ca88c7023bb7619381396d40a111a6deb40b80a76e86e9636851
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
948KB
MD5ae3e46694ac329f8d79a06589b60ed6e
SHA1b5e5db8641afd0e5eb9dd73f4a51e690cadc34f5
SHA25690e05a25845ee1132686f8c2c9cf6a4d9a9596be705c39d4cec2cc38e92b52b5
SHA512c3456a616bcf491a6512877edd08ca4f640f21272a58d2b7c1ad2b5963d3419db5e953a55d41e76ed8a1cf613b09cae17d8979198ecb6667ce11fbadc30466ac
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
672KB
MD5dc0ad163b13e0f5be1b83107ca07b4b4
SHA1e23fa8799f2f5ffdc0076e4f8f269423bc1c2246
SHA256740ec0a84b2b69041405e211c1af2b53c4acb580d0f03d9b03d5d63a0b803ac8
SHA51287883b46f79f666079eb2204564cc066116e0930922ce9f086feb6532e5e3fb62b3777001aeb83e255b82d4d66d9987ecf04afc5b6b0980c61185baaca34f176
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
1KB
MD58e3ae67d051c8a6c7a25fe4a13d47302
SHA139061781c41ee999a57031b1a751c2c103351acf
SHA25657c6d2f65b9e96c0129ea10a605a4ff93a412aabdd4dce6ec090f6cbe85f1d10
SHA51226780913b414936b0423f8de9ee7fd8d19ee5dc14ac88f755881afe101c218c0233f49fbdb9d6e6e781873bc00de5addb335b15f84962deda7777873772c3782
-
Filesize
672KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB