Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
21-10-2024 21:07
General
-
Target
384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901.dll
-
Size
684KB
-
MD5
25f805609c924aa76767968ad908ffcb
-
SHA1
191c36a856126af5946e9de9cea3a7cca9d8a961
-
SHA256
384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901
-
SHA512
334526e7f8b539fc079c1a8fc2b75ad0639f9149eb55651cbda11a2f7be30f9f1de8fe7882aca33d5f906c3a38b8fb17b68ad3b5282c1fa4339fb0f97656328d
-
SSDEEP
12288:/fndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:3dAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\384e3ceb6e99ca5fd18c7acad5e19854eb15dfeee39eddef8635d2b65be15901.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\9ifeJFfRM\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\9ifeJFfRM\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\tNM43eAJ\ddodiag.exeC:\Users\Admin\AppData\Local\tNM43eAJ\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\1qMGNo4d\ComputerDefaults.exeC:\Users\Admin\AppData\Local\1qMGNo4d\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD5cb006cafb4827a641852e3f66753fbc1
SHA12024dbfc88964fa6bcc1a4ca199fbe88f8b9a448
SHA256aa1fd26147db5df7fd82aae3821f49900377eb58976328cd284555c95f91d97e
SHA51279653378871337abc78108474cbbcd3cc0d6e0b4bb925f3343ce3beaafcc0f27aeeb29570e870a0566c269df6277316e72cb72a0ae190f7063d25dcf60e70dd7
-
Filesize
688KB
MD558fb4754135a95e1e196f1e2330beedc
SHA167e8bec6ab685dd7ee7d25980e7ca6eae2943bf3
SHA2567764b0011c58d8d90b0c7c6d38389efa7e3c1ddc7a519ed82c4b6a5614ef7b28
SHA512bceb5b20bc13912f90caf1447ef317d1cb1b58c6cfb6f421cedaf8db1b0e0d775c5f03c17fb348032ceb2c673e7aaad054b6b91f83e02fa8ff4ae6ad740836b7
-
Filesize
688KB
MD5f294069db8a6a012570f86037969aab4
SHA159992a4254b6584ec64a423e69d26846afef4f7f
SHA256b33cc5afd62dd89472504d8d8097b20a470ef006b917b83750ea2e0002165565
SHA51217ee8cc36168ba5e3edade0255f3936c4ad4ac59be09ac2976c4a187588e445bee8b8939910d329c5f0e244e8541ae05b3f13cddbb0f5169dc6aa722225aa61c
-
Filesize
1KB
MD5658372f5c129615c266ea649c9275ec4
SHA145ffd2fd8031bbf9e78bd50175c3414ed5df62c3
SHA2567bb110017f7a17dcec17a5d8c283a897920e425b89b9cfe535b971d0d8290156
SHA512474c5e4f465ec4b931489c21926b4dae55517c92f2d9ad10f22ff51050a2c7057fc63b26aa6b2baef2b16674545fe928c5e7805cda00d76f465123719b5a33eb
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
688KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
28KB
-
Filesize
688KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
684KB