Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-10-2024 21:07
General
-
Target
022313a6879b728319802186991b9397e351b4d9cb7ad36120172e81bc035d8e.dll
-
Size
692KB
-
MD5
a1e6e208002d96dc17583432e060abc7
-
SHA1
4fb85dcc732c7e3e33efe9b9b7a41e94afa4c113
-
SHA256
022313a6879b728319802186991b9397e351b4d9cb7ad36120172e81bc035d8e
-
SHA512
d73597eddce800228be18aafdcb03e9b4fb78e15efd00ba7f44a4e38c93ef6240c8e293543a621a223b7eaf074b3d8f74f5caaf68753a18a938acd5840cd608a
-
SSDEEP
12288:Kfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:MdAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\022313a6879b728319802186991b9397e351b4d9cb7ad36120172e81bc035d8e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\mrgHC48qy\sethc.exeC:\Users\Admin\AppData\Local\mrgHC48qy\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\d1y3Q\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\d1y3Q\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DWWIN.EXEC:\Windows\system32\DWWIN.EXE1⤵
-
C:\Users\Admin\AppData\Local\edEVmK8W\DWWIN.EXEC:\Users\Admin\AppData\Local\edEVmK8W\DWWIN.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
MD54de096d8b49f2bd6bbff32eb2659f353
SHA1ed56fda0f228c8cefbb472588f4ff3dffa0cd1c8
SHA256df3b94ee9d9ddc829ab6478744eded991bd6c9fece9fab0d5bf0fa20f396a937
SHA5124d6dff9bf34286a1a6e208d63dab72e924ff6b115e0979552c3d1829b33ee160e118fdb6359133515e6a993452b2e02044b6b2c7b0d533102a82470d0e8b5272
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
229KB
MD5444cc4d3422a0fdd45c1b78070026c60
SHA197162ff341fff1ec54b827ec02f8b86fd2d41a97
SHA2564b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0
SHA51221742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553
-
Filesize
696KB
MD5cee25fb522d4d6ba5e28c8fd39646f49
SHA1c911e78432517a6afa8e32c4838b5b1f89397f6c
SHA2569f28092cff60af5f54833f9b5fa4214d5694e67352e01c4dde13359a18c05e35
SHA51253caac1c2d8fb452afacc9e309ca559986a008530139fbc880ec2161439744737d49463f293c27ea054c9bbad091f869f5ce0b26b27e5c41cc4b63bf278eb648
-
Filesize
696KB
MD5e33908510df7a020dedfad2224230983
SHA17aec6dc8400c2673e5f4be9765de8be5b673827a
SHA256fffea265a677926c35d2af8aecab88b3e459fa867bc67792a56d5b8e7a23e841
SHA512350d3afb4cf2fc14d75a1eb2cf7b4cb2ed5e1905d528f9e95f5aa0e538a18c12660c2fc8c089e7c0ae758f73c4a022c9a7ba9a87d84ff3fbdd0b6b1c15220474
-
Filesize
104KB
MD58ba3a9702a3f1799431cad6a290223a6
SHA19c7dc9b6830297c8f759d1f46c8b36664e26c031
SHA256615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8
SHA512680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746
-
Filesize
1KB
MD5c5f4e0338fcc4bf6a085b945f44d4c7b
SHA18fcebd213024316b59e3b1e99c089d1649f4e799
SHA256f90d1d3cc96cbf85f613ea71193f4c5753bd0e81e8b7830d2ef570517f03a220
SHA512578fd07a9a0233c9626ece85977bb0c1b0aaaf36cfbcbacb34d7e81f7fee8717d39c1c70b06f3e4b41095b8db7899e3aab458ad765d8b547b0405ae0d1ebe8d7
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
692KB
-
Filesize
64KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
64KB
-
Filesize
692KB
-
Filesize
28KB
-
Filesize
692KB
-
Filesize
692KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
696KB