Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 05:07
General
-
Target
12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108.dll
-
Size
668KB
-
MD5
53f22cec29ddc10f57ffe3e4348d5d8c
-
SHA1
9d3c7d20606c1b9fe7f302b7d62eb9fbfd66a5c8
-
SHA256
12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108
-
SHA512
6ee3f97e5e536b31ebfcc422eb5fcfdf995bb49ac79335bb1e9e36cc61da9a7899cb72e31147e44a50dbd247231caa700c27aa26388792c422e256920c955e84
-
SSDEEP
6144:D34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuT9:DIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12165e6cc5aa936770832b61eada40b38d30dc9ec123117868d795165810d108.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\MX9IqR0\AgentService.exeC:\Users\Admin\AppData\Local\MX9IqR0\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\9TNC7qp\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\9TNC7qp\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\4188I1A\DeviceEnroller.exeC:\Users\Admin\AppData\Local\4188I1A\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
672KB
MD50db1d7d267d323fd864ae972af2ab3f8
SHA1e4b8e54eed55307cd86d54facfb7b6fa81c25add
SHA25635eb34495555f0ac66736894b5af1516ef653c61607a0bac2abbd6a39b4f9c68
SHA5126edd88ee9cc4ca196ac289c9928f4aeb3d400686eb119e7551524a55ac52e74d44dc5394b15e8fb7281de6e26cc584eca86829ba408f3e364733550e943809dc
-
Filesize
672KB
MD54a9aac86a16557797a3e7bfac81e15c7
SHA1b99c8d017bf731e84c3847f3cc9f0a8537ce1d96
SHA256b4dea5a4cbd8ea13e1453039531348eb73e8d1b04e3b512357c9f707d727dde5
SHA512c92dc7c571339a65a435c0d38e947ba23791bcafe1e9582f64f3c81a7acdc87854f54ef47e11a038b7976edcb1be7d7bf670efcf596a016d79c440121cd0b17d
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
672KB
MD5f9a5bfeb8a17bac78925614e5ffb38e9
SHA1771ee6f94fde081a9c5e4a353d66d74107a5be5d
SHA2563f14951bf73bf8e773d2c3dc568eb922bbe502cd367cee29b0133cd6e987a1f0
SHA512ac934ed9e2ce9bf0826fd26aa967f97f42974f639af67ca65e0792952a5d847f06b8c74ab5981b586147dc0c16b5d4e887476fe29200d60d89b3288c6eeda8d9
-
Filesize
980B
MD501dabd19e8712ece96841e8e32209fc6
SHA17a7ae73d36e2f7ff52fdf58d58771eb360b9b532
SHA2569c1e20ef3447a4ab1ec2bcc41ca44f628953a96db8915a48c1b2a48b894bacf7
SHA5123228155857f2cb64d9e8ab7da5729003acf4588324dd6c2091adc09f4c8a239a2c6b5245088cbfbab940e7139ab3782cafe4311058863eebda5ce30f8cb8fe9f
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB