Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 07:16
General
-
Target
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll
-
Size
952KB
-
MD5
b432d15a89c0b864b8f28153733c9e2e
-
SHA1
7dd1e2dd2f3a78cecee6cee02c5725d93a412b46
-
SHA256
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a
-
SHA512
4c5eaebdb580839d6611dd34196bb084b79550ee2aa0b19ce26175fa5746ab6921a5b932a59587431abadba12ee95b048f0d2a2bb66e4ca69597bc51f41dec8b
-
SSDEEP
6144:p34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:pIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\9Z7f1t\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\9Z7f1t\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\MMb3\Magnify.exeC:\Users\Admin\AppData\Local\MMb3\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\kZE\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\kZE\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
MD5531ac372a5a5a192037e803f6312289d
SHA1d229c3ee83b88b695dadb1d2d51ce714ffe71366
SHA2564e7088ca73ea2f919cf0f0d7becf8b9396b9f61ac72a4ee20212fa4b49aeaa18
SHA5120feda61cf5207d3c046002360b0f8f6923f8e039b137eb8b790d2ca9f3dbf25c1f920fe9c43f7690f950427d4fa6dc2fad25b7462141e1b7e98bfd2ec4d210dd
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
956KB
MD5f4e54b76f1a46cac2b9f48bce556425d
SHA104d9c998e794062fef71021f5e4708e18486befd
SHA256397549f5f54d12d10628ba300b30d3d2e75bea0b9d45acaef36a46fc99af993d
SHA512958e9d0980ecded609dac8149994327e6abd858a303c34e30ae10ceefaf45e7d271dd633752afcffb94f1ef79aa4e5a02cf1a595dae0beca0dea3eb6fe2df2ed
-
Filesize
960KB
MD502ed3c524f0fcec61c0b10afd00168f7
SHA1ee465d905996397d690b50c869ee437435a2c3a0
SHA256aa6cceb3cd557877f6e1f66c9dfa8b4dc35503ae70b6cc1d47e9305ab7b7bb72
SHA51262d6290fb70ff0290705f6d860cbcbeb7c53ac46a7586fe1c843cfebb7e7b70aa66b08a5a08dbed157aba1241bac7fa3627306b685017972979f72b18f4a24b6
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
1KB
MD5c428f26c3663a31266f0d0bff59ff72d
SHA1403592a99c0f15411cf9dac60e7833a5b5c05c67
SHA25613b1a8871450d6c03c1aea1303e8464aeccb3c059bc0463d969d77d5a97f070c
SHA512306730fde3ebebc964b6efed4b0f85c519f0501a2579105cc7fdf4a5ae441bff540754199c28677d7cb2520e7975f8ed8d4b44b672c0a6fcc899a3b2523dd5f3
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
64KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
64KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB