Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-10-2024 00:11
General
-
Target
cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c.dll
-
Size
980KB
-
MD5
2f7056cdf2abb1bc979d8c4ebf8ab217
-
SHA1
aca864752fe83b828993a8f4c03ec0b80f13254e
-
SHA256
cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c
-
SHA512
b6cc46f3abd4164b759ab0f777e04412a5df96a2c81f946b5ccd7d47409c8ab91d75f58804311516254f7965d0547803a2840b182292576f18d2a932fb1a410d
-
SSDEEP
24576:qEwXnOAx5HcDM1Sxd3ChCHg2/P9yGoch:dbM1SzCoZ4Gdh
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cb0a5e0097de33fa6f57dbf7ccaf9034c66400a825375093d5fb0a139968087c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\LSF3JA5P\sdclt.exeC:\Users\Admin\AppData\Local\LSF3JA5P\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\R2SA\dccw.exeC:\Users\Admin\AppData\Local\R2SA\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\qBFz7ylvg\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\qBFz7ylvg\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
MD5a920480a69cfd9107cc06a51db733b37
SHA1969f5c5a9f06f91f51829ffd8cfcc4837f5103c7
SHA25626d66765c92efece4a475fe2d45f8b7adc5022326e09fd7246f86f6fc3b0e273
SHA5129fae9030a9340ef55728bb8ab2569834168c707f6b0c46c1f97ccc4e804d2de8a39ef7237a2d04df1dd44ed9401f0630aaddbf521d796117ea294ac7e054a240
-
Filesize
984KB
MD5cb726855ce6eaa4c3ed1ed3341087597
SHA198821f36bb419ae259319206c5a80e86c35b89d4
SHA2569f303aad5aadf6eafa9463577727bdd142c754989e34002c559bb38334d5d9f4
SHA512cc3d0e2a62c5b89eee2e39a183e7924ae3f08a5f85acb919723711d724ae3c12c6e9ffcdb5f56154ba15ac4d9e4cc01c55cc8cc5ea38458dde4c9a375a2d4f6d
-
Filesize
984KB
MD50f40db6628a2dccdf30ee0dbfc12af04
SHA1747de2c90a575675e04eb29d30cf8473ce1ef0d4
SHA256a1de40b761c24083b99ef92ddedeee482e3a4070d6db6eec1693dadd40cf5920
SHA5124c33fbed8723e8e8c903eb497e2f4176bb2b0af5d14c65f6fa50c90b45fea1e323114289e1bd24966c7d50b7054031623f39aa71ab61c1a72a1deadfd05cdb4f
-
Filesize
1KB
MD545ff2e491fcb1790cdce6c44e6d4e601
SHA1e1835b7750002d26f9c05dfdd6977af5a9c34c08
SHA2565dc90e22f0a43dd90141e10b5722a9badbe509eef6b51934ebd730f934f473a5
SHA512f05af8b6fcff9c1e16cb3e37a9fb550b1a4985523f97fc0c7e2fddb52fbbd5f3cefa1a81f0ba75a1fead43080cad58a0e3f3d2c2955ace1c1267f786621917b6
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
8KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
8KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
980KB
-
Filesize
28KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
980KB
-
Filesize
28KB
-
Filesize
980KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB