Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
d616010470e5a7f7633e4f505709437b4d672312c57ab1724f3339bbc5acc727.dll
-
Size
664KB
-
MD5
192f752bbdcb5e33312abe8fd40eb318
-
SHA1
efaccfee37c0fa32a1b45b156ad4e65a33bab91e
-
SHA256
d616010470e5a7f7633e4f505709437b4d672312c57ab1724f3339bbc5acc727
-
SHA512
0ed59a18735e566cc458b3c3dd27d07fa62d1ec55f67ea3e9f8779ac0ce7373da046ed4dc7b4420d33ec6e810b317f56317b8ba4861825221a2b4ed54cfc9f0e
-
SSDEEP
6144:W34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:WIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\d616010470e5a7f7633e4f505709437b4d672312c57ab1724f3339bbc5acc727.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\rAmZdgd\wisptis.exeC:\Users\Admin\AppData\Local\rAmZdgd\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\YzsiFAaR\msdt.exeC:\Users\Admin\AppData\Local\YzsiFAaR\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\3ri4\SndVol.exeC:\Users\Admin\AppData\Local\3ri4\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
668KB
MD566c7159405228266a68ff1bcd7f6e9f2
SHA1caf9f84ec4ad0991f8ed93b4732aeb7e9910ad18
SHA2569fdadac47237572c57513550937c1efba281fa3c1052be70d17dbeadb2c2580e
SHA5123a2887ba5185e4a841b1847428edfdf611e489137ba4ec904b16e5d532db7d1cccf51d151b9886c2467d03893eef59b87fb740b8c1688ff1181f2917940f7b27
-
Filesize
668KB
MD53c7a59b3b71836ff7cb9f69fef18718f
SHA19196925b179c2f21a5da1b628d949d428fc90712
SHA256665cf77801a4bde80ea68c29fef695f09adf8ca6d43fc4ae556852c79312e21e
SHA512318172e85efc0404d3dc13819038df1057e3edda8b7386994291910778382b43763f8d2c205b9860224568014b2a61ebfb09c959b9020f31ae1bee5ff9ef3483
-
Filesize
668KB
MD5ede7412998c3777d51469d8ffaee57d7
SHA1e68fa68701d3e428058a67583acb0f7c6139e025
SHA2561956a662b3c06140fc00195901aefd1a48f83818c36fd6b55c275b8114b7e17a
SHA512a5bffeef9c37e145534febc95565d16dbd15fa98e870e26306eea1ea4d2868fa9f1f97ba3794abaa296a453d6cb3a5584f999ad4eb3fd8fbbc26afffe4cdaec2
-
Filesize
1KB
MD5714ee5ea82885e28e3afe28f25893d6d
SHA14b1a2b0d8dac588168431e6f3f07214a36b271f2
SHA2568f03e65aa226b91d453fab86c64e61fdc93922f494f990b5ab6dd5821e79e7db
SHA51233a60f124f6dbec7998b264efff2709cde2dde275b2fafacf67ccdeebd93c92a0d27897c341e794c47b27ea5190badff31a5feed5fabea1f78cd8b009b716ae8
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB