Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
18-10-2024 07:17
General
-
Target
349a48524a21cc6f8d8aed8caaa9fa006a558a7551506d831a29ce61ae7ee088.dll
-
Size
952KB
-
MD5
e9caaf99ddd15f21e80be6ad6ba0061a
-
SHA1
216eebcaf321981fb3d87b6c49baa53e35ce405e
-
SHA256
349a48524a21cc6f8d8aed8caaa9fa006a558a7551506d831a29ce61ae7ee088
-
SHA512
cbe0c6597f954722d2d85e599c55a96334d7c650beb9df375e7a1fb55eb92d1697611ec33d536645c41b856d392c9e5f0a0a4296180bae03ea2376514666d5e7
-
SSDEEP
6144:x34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:xIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\349a48524a21cc6f8d8aed8caaa9fa006a558a7551506d831a29ce61ae7ee088.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\Z9J4k2Uc\cmstp.exeC:\Users\Admin\AppData\Local\Z9J4k2Uc\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SoundRecorder.exeC:\Windows\system32\SoundRecorder.exe1⤵
-
C:\Users\Admin\AppData\Local\P9KcB\SoundRecorder.exeC:\Users\Admin\AppData\Local\P9KcB\SoundRecorder.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\rQbwe\p2phost.exeC:\Users\Admin\AppData\Local\rQbwe\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD5ca9e83034e20a0fa93717bcc7f40146b
SHA10782d78e88e0f9b98fda5f205e8a87f85a2fac1d
SHA256fdafbbb5633437ea4acd6125961f64a5cc47e6ce058f782e151857f204a553ed
SHA512f28e48388dab95873d77cadde4e818d16216f82f29d82feee005fb18eab9130946cb197ba2eed77c75f79f85ea1c984d4c2c038bf1819db40fbb965fe67bcc49
-
Filesize
956KB
MD5277a45bdf56b62cfb4d1811d132abcac
SHA1a1563bec5846a68c48839a9c8072eb01e8175d34
SHA256561be4a292c2a283cbb8c7f39f02c5b6bd156b60d7ec4847e01dc23f75095b0f
SHA5128aaf4657e2429a6fb524757fc4c44f19abb2513b9a864d5c3ef9fa72cb73ea1dbb55644bbb456a92558348c020268adad40e121e9e65b30971ecd2d36d73c020
-
Filesize
956KB
MD5638eafc9fc34af999c3df461fa5f0aae
SHA15e18680a88d3ca0486e7446726dace7b25f3f040
SHA2566a0fa3e0c0b1a9ba67bf8f95d5faa4e618b936b0f0587764d8b788ba4664ee5c
SHA512b6f779de01501f1ed95d9a9637e01e63406c8edd66d36092784da4f8e66899a52b7bd90fc6220736baa49242b5cf003992a4ffff5e54d051cddb2185957e4180
-
Filesize
1KB
MD55d0593a690ab4dfc97ef03bc77cdc5c8
SHA1fb3c01c154374f675f852f715ea57ae4f349e8eb
SHA2566004b8a2127db1f5f35d36a4509710e132fc136e49bc2b93d74b95a419b19d11
SHA512f68c44fbadd4468408ecdd87e39eb5a3181b81a693bb4932ba32f2c3ccb4073dab39c9a8b856604c98eb483e20e3e1c486b569d23007c59a6da7055de8c4459d
-
Filesize
139KB
MD547f0f526ad4982806c54b845b3289de1
SHA18420ea488a2e187fe1b7fcfb53040d10d5497236
SHA256e81b11fe30b16fa4e3f08810513c245248adce8566355a8f2a19c63b1143ff5b
SHA5124c9a1aa5ed55087538c91a77d7420932263b69e59dc57b1db738e59624265b734bf29e2b6ed8d0adb2e0dec5763bfbf86876fd7d1139c21e829001c7868d515d
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
960KB
-
Filesize
28KB
-
Filesize
960KB