Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
18-10-2024 07:28
General
-
Target
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll
-
Size
952KB
-
MD5
b432d15a89c0b864b8f28153733c9e2e
-
SHA1
7dd1e2dd2f3a78cecee6cee02c5725d93a412b46
-
SHA256
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a
-
SHA512
4c5eaebdb580839d6611dd34196bb084b79550ee2aa0b19ce26175fa5746ab6921a5b932a59587431abadba12ee95b048f0d2a2bb66e4ca69597bc51f41dec8b
-
SSDEEP
6144:p34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:pIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\TVXQGNB\dvdupgrd.exeC:\Users\Admin\AppData\Local\TVXQGNB\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\4LY\osk.exeC:\Users\Admin\AppData\Local\4LY\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesComputerName.exeC:\Windows\system32\SystemPropertiesComputerName.exe1⤵
-
C:\Users\Admin\AppData\Local\3vbeP7bnx\SystemPropertiesComputerName.exeC:\Users\Admin\AppData\Local\3vbeP7bnx\SystemPropertiesComputerName.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
MD53fc66ec347a37b799fa658233ce22c68
SHA19efd7549ca465e2de6c9e94f0284b0b77ae96656
SHA2566a26883177444af49ee4abc14f7d4446535bfa202b2ad5130565388a324531cb
SHA51293fbe2acd3c4f724dea18f2022174f28eecf0e2f372c513c800cda6fc806245690313cb793fd0be21b708ec72ad7b8d2b7f9ca3effb60da57c243917754780b9
-
Filesize
956KB
MD5559224e6a12afc11123fedf6938a98e0
SHA13ac839e38a367237f7a56b11956157c50b37790a
SHA2565aca62a526be8c34ebfbf505c08198c850df6dcf7b450a72a689c869099861cc
SHA512ee27bcd14f0254dc270f4e571cba82f008692b7d38d84203cb83a63ee31d0d775de806b01dada3c386e9534506f3d5e095efe083fcf73b0c2ce34d42f60a94d5
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
1KB
MD5394bd824a6038b0e67f7415053283487
SHA1d25c21eac60911c4a0bbf65ec89016f6366e2dad
SHA256d69925e8eeaa7a635c126e4a347b0e0941b59537e81ca362eb73418f89199ccd
SHA512595c5553de0321a864d044823d999146b2b9b391b396a6225905becaa1221b17d65b710b0ced42774ee86a287f745cd85206b8dd859e6dc1386c23b8cfd90100
-
Filesize
80KB
MD5bd889683916aa93e84e1a75802918acf
SHA15ee66571359178613a4256a7470c2c3e6dd93cfa
SHA2560e22894595891a9ff9706e03b3db31a751541c4a773f82420fce57237d6c47cf
SHA5129d76de848b319f44657fb7fbe5a3b927774ae999362ff811a199002ffa77ad9e1638a65a271388e605ab5e5a7cb6ce5aa7fcabc3ed583ade00eaa4c265552026
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
956KB
MD5aae03ab958470f38de7ad7e4ee833b41
SHA1e167a5278793662281006bd81727470abb0876ab
SHA256fc941ddb1af205aa8852ceb6ce6f68215e63c6533d0977bc723c062b8421aa51
SHA5123273bb7c5960e7c12371bb055c3e097b7c79256c81f3422c8cc36cea7a8f26e49455dcfc96df3da3a04f6d0ed68151bafbfd02d94931cdb061bd4021700137b1
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
956KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB