Analysis
-
max time kernel
149s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
41614fc30de6ea778c6fa12e9ed5cb389679580e3903a40b3373d92b103eb010.dll
-
Size
948KB
-
MD5
80f06337c927418ef2dbe6efa147d64a
-
SHA1
4a016b8fe8c023f840f18d3b40f6e6f44fb9d6f2
-
SHA256
41614fc30de6ea778c6fa12e9ed5cb389679580e3903a40b3373d92b103eb010
-
SHA512
0abe2424cdd1f23f60dea1a920aa930805f805a913c6d4916986329874fa1e4c6b5e22dc39123191c903460f21786b6e828447dc1bfbaa65576d11a479db18b5
-
SSDEEP
6144:P34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:PIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\41614fc30de6ea778c6fa12e9ed5cb389679580e3903a40b3373d92b103eb010.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\w6BmVUM\iexpress.exeC:\Users\Admin\AppData\Local\w6BmVUM\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\x30\wermgr.exeC:\Users\Admin\AppData\Local\x30\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\JK7\DeviceEnroller.exeC:\Users\Admin\AppData\Local\JK7\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\RdpSaUacHelper.exeC:\Windows\system32\RdpSaUacHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\k1l\RdpSaUacHelper.exeC:\Users\Admin\AppData\Local\k1l\RdpSaUacHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
952KB
MD5a43191805bc7dab35897a7cda8f5ec95
SHA130a23f3ab99aef5c9cde2dabdc3d6a48214d1e84
SHA256ee0a8b121efbbc9038995da22dbee15fbbc93a6942813b48f6567de7e960d83e
SHA512b1777e87aa924f9cae4827d411bfb55d072050c5a16d5d2ea5d7d5b7be8e782fde7f622aee9b598bef47d647be970eecab10707bc60830423bec85c662890d7b
-
Filesize
33KB
MD50d5b016ac7e7b6257c069e8bb40845de
SHA15282f30e90cbd1be8da95b73bc1b6a7d041e43c2
SHA2566a6fdd834af9c79c5ffc5e6b51700030259aeae535f8626df84b07b7d2cee067
SHA512cd44d8b70fc67c692e6966b4ad86a7de9c96df0bade1b3a80cb4767be159d64f3cc04dc5934f7d843b15101865089e43b8aecabddc370b22caf0c48b56b3430e
-
Filesize
956KB
MD58599c05a4fd2cd06808f6179608f9961
SHA197c6ae2e7b7897220afabf197aae550059121137
SHA2562e022a6b89b6a9756717df90a8d916bb7ac254e565279dddad9e93e5e1df464e
SHA512d87daf7280e152752b341f4a466bb38f0724bb74a7243340b9bbe0c89b3be99c10ecfc3eb86d7ca9f834f2d07cc25918482a29412cf6deaa2eac1c43c8b24728
-
Filesize
952KB
MD5b6cd9d9f06f30171a2c93c8a4de6e143
SHA15b7370656d2b8639c2c3c3e21658074002199c98
SHA2562bb3c56dfb26632dedf8cba4bf26ab829cec5850c027f5c675a704cd6cc58006
SHA512a506cff4a8d5f6f358003e1250fec45490992566f3f2b4c88a710cb870693f5add6d52b81e62d2c9f65f0ebfd692b5e5d0b6a4b5218536234d5f7344f10d4983
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
1KB
MD505cbb40660e1ec1b5ec4cd111e8fd664
SHA1f1dc7f52a43de83222ce5c3c3286b47a09e1829b
SHA256db90695097303daa77160f13e3f1a9d74d958d6b8e08479925f2dbe54dc0c791
SHA5125bc593a5b534d8a41115015268fd7b7e504d18fd38fcc0de1dba0cb6b31e1ef81226e70ddf04288918f7888219f1e9125adb32130d4e6ce93180482fa494a62b
-
Filesize
28KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
948KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB