Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 07:27
General
-
Target
9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7.dll
-
Size
1.2MB
-
MD5
02cc0f2d0a0c7407558ac5a569c4e04c
-
SHA1
4b7060c03c224e42c420651368c73dbddcc3a3e3
-
SHA256
9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7
-
SHA512
ac134e657c9ec47511245fdcbf717221a83eda2faea7e57560a59e212efa9312f4f13abc29b81be6210405680f507c5d921c4f6fe9ec933249c093e342eef554
-
SSDEEP
6144:k34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTI:kIKp/UWCZdCDh2IZDwAFRpR6Aup
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\VuZm\OptionalFeatures.exeC:\Users\Admin\AppData\Local\VuZm\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fveprompt.exeC:\Windows\system32\fveprompt.exe1⤵
-
C:\Users\Admin\AppData\Local\NwV0\fveprompt.exeC:\Users\Admin\AppData\Local\NwV0\fveprompt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\wHUP0J\rstrui.exeC:\Users\Admin\AppData\Local\wHUP0J\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5a86cfaaef710ed77d55060e9d8b4ae67
SHA1cf6d68a1634d261ec9d3baad02749bc88c2830e9
SHA2564f5d9f16a365d3e9f35d4afa8119e492a81b4a8516f069d23911752306efece4
SHA512ad9c37bb3df50b0481a851101422c52be3ec89cd651c741c03603a20f9758190e22e129ee119fe682fc1f511f1b717c3f9d0e4612839aee747a33eb088d28f2d
-
Filesize
1.2MB
MD5d8a9d1cdc11652bebca2c388271712e5
SHA12ec077f512ef571c0f882c30e6c991a372cb1b26
SHA256d6df7ae1573ff045611fefb0b80950a93be07a5f330a01976c51f43667f52b6d
SHA5122a670f62fe9202893ed14907cad4e2dfdf1c9632bc066e3df98e0f1879a70403b6e9d2bb246b527b34b0d90f46c1c8d6e5950b3dc50062f1aaf335a494340000
-
Filesize
1.2MB
MD531cec24b52d9eb251e64e5df2d8d1e75
SHA110d0cbf5c7d883ab80a1f169504b35767b2738a5
SHA256ca2babe6c21554f0d041382bdf7cb951ee76499346fb9b7f80b0729f92e734d8
SHA512314e16b4bdde882e6338e68edd778804f21dda0f618dddb7ce55d6af6cd9484302be26ee0acacd6db7d877762f10da624b404794f665fb0487ff630e7d80c62d
-
Filesize
1KB
MD5de07ae315c7233b66057b516106493d6
SHA1ac053406aad22db394315992751ca26bb42a714e
SHA2566d37217184797ee61e0aa4ad73c1b82b28a622c25873398855c714d1b2ec2b61
SHA512bfe4863605b897538263c00dba82548c449fdd088c68c597b90a22fbb4807bdb801ea43cfa8e2da15675b97d6b219d53105f2d4e35c6d434b8d28dc34184f1f5
-
Filesize
104KB
MD5dc2c44a23b2cd52bd53accf389ae14b2
SHA1e36c7b6f328aa2ab2f52478169c52c1916f04b5f
SHA2567f5b19f2c6a94833196ee1929d48094889b33b504d73d3af88dd857ceaf67921
SHA512ff083f74777a9cfc940d4e0cb55886397e27c85f867de9a5dd9ea2c2751d2a77bf75fe0734e424d9678c83e927788d07d0b3072024f7e5a9848c7ff1aa4090dc
-
Filesize
95KB
MD5eae7af6084667c8f05412ddf096167fc
SHA10dbe8aba001447030e48e8ad5466fd23481e6140
SHA25601feebd3aca961f31ba4eac45347b105d1c5772627b08f5538047721b61ff9bc
SHA512172a8accaa35a6c9f86713a330c5899dfeeffe3b43413a3d276fc16d45cd62ed9237aa6bff29cc60a2022fba8dcc156959723c041df4b7463436a3bdabef2a9d
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB