Analysis
-
max time kernel
149s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108.dll
-
Size
668KB
-
MD5
53f22cec29ddc10f57ffe3e4348d5d8c
-
SHA1
9d3c7d20606c1b9fe7f302b7d62eb9fbfd66a5c8
-
SHA256
12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108
-
SHA512
6ee3f97e5e536b31ebfcc422eb5fcfdf995bb49ac79335bb1e9e36cc61da9a7899cb72e31147e44a50dbd247231caa700c27aa26388792c422e256920c955e84
-
SSDEEP
6144:D34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuT9:DIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\cz2xQ\mmc.exeC:\Users\Admin\AppData\Local\cz2xQ\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizard.exeC:\Windows\system32\BitLockerWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\3az3iwN\BitLockerWizard.exeC:\Users\Admin\AppData\Local\3az3iwN\BitLockerWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\Ta9bMC\dpapimig.exeC:\Users\Admin\AppData\Local\Ta9bMC\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD572bb0b2077d377a9ec271811946c321e
SHA1d9c9cf1a2a1176bae36a87bcab40b7a64d782d09
SHA256d9550656de5ae25e37bf906a1c175df38820193e2bff5a30526bbacc8c4dd942
SHA512dcbf2f956ff24f5407b882355fb578333d0f9018222492977331abfa68c5ca9c33dadfb1e8ded98eb11a8edeef43dee3310a3eb9ba89f318a540d0016a597cfd
-
Filesize
73KB
MD50e8b8abea4e23ddc9a70614f3f651303
SHA16d332ba4e7a78039f75b211845514ab35ab467b2
SHA25666fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1
SHA5124feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc
-
Filesize
672KB
MD508e7e168d17bd6f499c6b7db6a82dbc6
SHA19235ad78fa903438a968d435093e0a9459156bae
SHA256f8bd479c4ab5e4d5cf1ba757e8dbe837c2948384a888d0dc4cc95be708e43bb0
SHA512ab7b8936bf951beac30caab88e4e74bbd9e541d3855ce10e476104d7e69592f8307e81557d4714999f6911e49e93cd64dcf4c87f98e0323044bbde18cdb3f327
-
Filesize
1KB
MD5abf16ead421073215dcec1da9f8f8cc7
SHA1346070b34f2105c9c3475d46e26fe5477ce9a4e0
SHA256132feec79815a799e91ff90d005096117b90d933b4e99f3d2044fc4214c7785a
SHA512f802363e2ff4bd5a1deef7f69d777385baacca676bbf294cfa4003210e1c0f7487e92a978d899527910381efc54d1e828cac0238193ada1242edcbf27bb3b3d9
-
Filesize
98KB
MD508a761595ad21d152db2417d6fdb239a
SHA1d84c1bc2e8c9afce9fb79916df9bca169f93a936
SHA256ec0b9e5f29a43f9db44fa76b85701058f26776ab974044c1d4741591b74d0620
SHA5128b07828e9c0edf09277f89294b8e1a54816f6f3d1fe132b3eb70370b81feb82d056ec31566793bd6f451725f79c3b4aeedb15a83216115e00943e0c19cab37c9
-
Filesize
876KB
MD5613c4c9d44b6e3f8f30ab59ad43c570b
SHA1550420977cb06e0d21463ceae9c33c36d1ae15a3
SHA256d06d48f69089ec566aa3e2102bd392c3bd74704e1cd0d78f0aae90bc10e2ec28
SHA512e9b98710b7d7593ad79b7ea7dc6e926e3b2a32979d67a54b0e7cb76c3841d1de6830309c11801c9c475e35375938ba21163b27b977c70fae7cd6a784e371fe4b
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
876KB
-
Filesize
876KB