Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-10-2024 07:28
General
-
Target
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll
-
Size
952KB
-
MD5
b432d15a89c0b864b8f28153733c9e2e
-
SHA1
7dd1e2dd2f3a78cecee6cee02c5725d93a412b46
-
SHA256
4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a
-
SHA512
4c5eaebdb580839d6611dd34196bb084b79550ee2aa0b19ce26175fa5746ab6921a5b932a59587431abadba12ee95b048f0d2a2bb66e4ca69597bc51f41dec8b
-
SSDEEP
6144:p34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:pIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4b773db138c8cc3dc18a140ff7641053a01214ebb3dd8135e53e8d47e9f39d2a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\6QOJ6qM\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\6QOJ6qM\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ApplySettingsTemplateCatalog.exeC:\Windows\system32\ApplySettingsTemplateCatalog.exe1⤵
-
C:\Users\Admin\AppData\Local\PvX\ApplySettingsTemplateCatalog.exeC:\Users\Admin\AppData\Local\PvX\ApplySettingsTemplateCatalog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\p4ubXP3\rdpclip.exeC:\Users\Admin\AppData\Local\p4ubXP3\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5e4d5913d1eac316e422260c2c7b606e3
SHA1c0421c5ac381d3b70788982414976ab70fcf3381
SHA25611a02fbca00543c7ba03351b2ec186d23ad034848085f76502c29e2a8dc13799
SHA512c4207d5fa1ba092e20b71466a05ed9223c24606298227769c248867233bb1297f523cea1b03a5869168380f2d1ad447538b1883fb94c87fed1112ad9f9e2e0d2
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
956KB
MD59e27ceae022cf6569d5a7c52426d1c1f
SHA1166c880683253ecc6cf2c233563c8e399b86a58e
SHA2566ea5d15a141b6f38e5994ee17c35671d75758524c41600e4498b95994f9b9936
SHA512b41a6261199080d478a67cbc367323c3d21c131e9c14d7c2b4d2510a688a48c4cdbc8b6874e2675c327c1b711206518c89c043a27278714f350300a2389a24ca
-
Filesize
1.1MB
MD513af41b1c1c53c7360cd582a82ec2093
SHA17425f893d1245e351483ab4a20a5f59d114df4e1
SHA256a462f29efaaa3c30411e76f32608a2ba5b7d21af3b9804e5dda99e342ba8c429
SHA512c7c82acef623d964c520f1a458dbfe34099981de0b781fb56e14b1f82632e3a8437db6434e7c20988aa3b39efde47aab8d188e80845e841a13e74b079285706a
-
Filesize
956KB
MD53e8c27b6083245adc28d0d22a18b03b0
SHA14935842193027c4b654e9dd904ef7f3ee11d1863
SHA256c91b896ce895c40eb8d917df1a404c9a26372f6bbcddcde3f1e4f7ff8ec0415c
SHA5122975c5621c8bd7ba4a3dd85191fe062d0c53b7cdbd691b267285ce50c27188fca49ea1d539d61701b4b986bfea21b5f45921275f9d5d045663a465367236969b
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD5d3ce034234728aec3a08f47bb5b49f11
SHA1a308d8b4d654827a8ad0a44615ffa20139c7c75c
SHA256cf070ce90615fa9359613f53ee4525d09152d94e6f2c552a6ab0d1bdb607c85d
SHA512c3b52f70037b7363a3312efe41f6873b903555a9e4071cac9811c1da8e45fb3489b471e7278894d0501f957bc6d8cd029cebf9ce830645f0ed43ec2407584177
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
952KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB
-
Filesize
952KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
28KB