Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 07:27
General
-
Target
9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7.dll
-
Size
1.2MB
-
MD5
02cc0f2d0a0c7407558ac5a569c4e04c
-
SHA1
4b7060c03c224e42c420651368c73dbddcc3a3e3
-
SHA256
9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7
-
SHA512
ac134e657c9ec47511245fdcbf717221a83eda2faea7e57560a59e212efa9312f4f13abc29b81be6210405680f507c5d921c4f6fe9ec933249c093e342eef554
-
SSDEEP
6144:k34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTI:kIKp/UWCZdCDh2IZDwAFRpR6Aup
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9d547a1ca3ef9b612354dc907c31c5acf7310f540dc48686f3157398d1e53bb7.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\HDmGBg\SppExtComObj.ExeC:\Users\Admin\AppData\Local\HDmGBg\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\IoYtkZT\SndVol.exeC:\Users\Admin\AppData\Local\IoYtkZT\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\ijI\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\ijI\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD50728a7c33c9626b51e3da5f870901799
SHA1be72dcbc325fe4f9ff395aa9cf81d889d88b330e
SHA2567a466defd1e9fad8af2a1ea282529ef1ff750c5532eb1066a5287bf3c02a993a
SHA512d3e39ff42abed70cb7ce041e2e9b77420a20fe958fe6791caad89345cf199814949bf10cd69d08563b4a72c4c01d8801ab005c7fe351ceba021c2c6aef61f01b
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
1.2MB
MD53f84d71789f571748a008e7ea8eb4b83
SHA1102133013d2aa710ea217a71352a6a874d8853b3
SHA25613b3e111fcf8b3ae605e1d4cb7d68578044097d851cf960c6e51ef907fa14283
SHA5129e84016d514473668c92132d49c4e4d5e624783cdbbfc7da9db4b34f1a83cfd09b71001bf382b3741b175db761a7a28589ba108f79a3c8e0edd57566771408b0
-
Filesize
1.2MB
MD5e4080470e2c7de150661bc19b8420c8d
SHA1ca86196d3b487ae0099650587835058a264ca219
SHA256cbc40f3980ce4583d0679448b12f1c949f3b96079db480d06404edebff5c6a23
SHA5126d32b1795d9080426e5e6139dc91eeb19987c61d94c0f05ecfcf08776bbff0380cdc303b74b88a8da8ace48e430f1aa8c5f9eb339a88a6d24e76ab11c1ab5e8c
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1KB
MD538ea8a90096e68a6b6dd70778c9846be
SHA1cf2146d369121c78ceb13377c143b3c094aa50e7
SHA25691635cb55d3f2a9632d7e05f6b0be8f36f5cc1c6658afcee0aedcce6b0d8ee07
SHA512a82446c4a423cde60d1bfb48b3448340cdd1f8a78c617977e251acf9bbc624e66531caf6e572e4e7490ae5bcd6beb21259a0ce123dc01035aee9ed652d414d2c
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
64KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.2MB
-
Filesize
100KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB