Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
-
submitted
18-10-2024 07:23
General
-
Target
935df89b2b9b8b96959f35ffdf9e2bde46b01560f21c729b00cb4d13e0ff02fd.dll
-
Size
952KB
-
MD5
97a982e24ffe6987e49fd0cb330a17ec
-
SHA1
404d71db7a082078c62ee0811513d80a083f0c39
-
SHA256
935df89b2b9b8b96959f35ffdf9e2bde46b01560f21c729b00cb4d13e0ff02fd
-
SHA512
11fb5562e1f5c5a19fd7ad769be5c786d5abc69105c1dea3d8854aff57e525c9a95bf78c798c43d1665256f128fb714ed25380a970a7c6bba21d2f8709489f31
-
SSDEEP
6144:534xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:5IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\935df89b2b9b8b96959f35ffdf9e2bde46b01560f21c729b00cb4d13e0ff02fd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\Uo5cA\rdpclip.exeC:\Users\Admin\AppData\Local\Uo5cA\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\wqa\ComputerDefaults.exeC:\Users\Admin\AppData\Local\wqa\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\WJ99z3\raserver.exeC:\Users\Admin\AppData\Local\WJ99z3\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960KB
MD5af9163157a88578547806254108f3261
SHA1935037af0eedd61ad598e8cfa446af90affb2dd3
SHA25661b03321dde4c38fe050ea05715915b4d570693ed5c71c7dec39411a8d52efa0
SHA51265c451ebcc3d35146a55aaed44a52342c7d89d444fd1bbbba7e5bf40abd8be11c99fe79c778766d332c012e2937ef320c4bc785dd66bbc2f6292093c6d7f03a2
-
Filesize
956KB
MD51a6e933e6c1ac67ce81809692cd61715
SHA1a6782c7ad7a00d63d2eba10fadb62b43667f4c0a
SHA2561b417316288bda8ebb60f80169149e7a2835c9c1d96b5d77ca7648c91cc30296
SHA512bca4751a3de52dd4ba6f284764574a200224ca6a2490972a645941e715b98f08456b63c8c92ef5d4255f3edb90598c557bc5e4ecd9611bebcbaf8492d15649c8
-
Filesize
956KB
MD598bdb39582de405d825063d643fabfb2
SHA1192989f894ef08e3a18f5a1d9a0c33184f6cd6a9
SHA2565fa1b78f3881c50556d85bb5f6258f67683972a8035736fea3d61a87fbc29152
SHA5120c5085cc4b75eb129dded848ae4f4e1c5fa59f4f02cb598c9077749e9bb24b8ce21947a7246785829fd98a670a363961c1b5e8e556e089aea16cd3531e1b6d0f
-
Filesize
1KB
MD51e423b09fcd0309cc1e309eb940413fc
SHA139972b56007c082e7a88748f80a13f824a746bdc
SHA256a48c3fe8e018c92da893572f766c7f6685c801aef78caa04d367a9e8b2ad0db1
SHA512392c6dd68c9b7a9947a8447e247367fa3c24b4f819babd51ce76a197f766401d183e1431bf4a5971a620811ccdb7521c1b678d5f60c2b035afc64261a2976491
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
123KB
MD5cd0bc0b6b8d219808aea3ecd4e889b19
SHA19f8f4071ce2484008e36fdfd963378f4ebad703f
SHA25616abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c
SHA51284291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
960KB
-
Filesize
960KB
-
Filesize
28KB