Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
22-10-2024 00:11
General
-
Target
f4cc073cc601127a558b1196c98d6839965545cffad19f38370158a6450e82f3.dll
-
Size
704KB
-
MD5
32d919c09f97767d7a0c7972b2b52103
-
SHA1
7a83575a7cab12034630cacb854746978e03e7f5
-
SHA256
f4cc073cc601127a558b1196c98d6839965545cffad19f38370158a6450e82f3
-
SHA512
5a1a51e61107464ed813eb6f9131d6a2be7993eaa8c43f7e03222db2a35152998a67924a16a4b91e8a839a11948d925ff94930248b2691cafcb7a26159139ef4
-
SSDEEP
12288:mEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:mEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4cc073cc601127a558b1196c98d6839965545cffad19f38370158a6450e82f3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\pzi3O\mspaint.exeC:\Users\Admin\AppData\Local\pzi3O\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\uZW0xG4p\dccw.exeC:\Users\Admin\AppData\Local\uZW0xG4p\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\1P8KB6wFT\UI0Detect.exeC:\Users\Admin\AppData\Local\1P8KB6wFT\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
708KB
MD51b0d278b79a64cf649fe8ab38158dba9
SHA1b888df0c4dedb8f7786e7a68190e0d6552b3d45c
SHA256810ecf11aa5d5ab8b3cd5d4cc3ea877b873be494b6f38f8bfb63dc60a08e6d53
SHA5120724129e44be9b3f43231b26f016e9a9426bc5465cd1735c38b9a80ab9d5b6ead0358ceb227db1a40ce04fe78fb776ec0888eac816affb3067191ca5cecfdd12
-
Filesize
732KB
MD5aea3a5f0afbacbb700d80308a4015661
SHA1e2c37cca838b88fccbf4b9ea098e226f33f4d0c9
SHA256c105d2097124f62bff6026020c0d5596330cb47e88abe00b480a9978c56f9676
SHA512b8354452fe32b418a692d4c38f21759cde55f2ae2f3cd3eec3e7b30ad947a95075fc3f421e1473ea8981e3cd60a154b782eda16d46a65422f7ca82254c514259
-
Filesize
708KB
MD5a702236f4e6c0eaa610866be52a83d95
SHA11540c0dcb6f9e3fd8d17759a2b8a24e17103fc38
SHA256eefa46f4893f8f6b2c1409643eac512092eff9509a5421d711ac70efbcddbd7d
SHA5125bb1736ad3c21dfb4585c79f55619d6c71de6c3c8a681ee9b89fda9fb79d980ffe738e137e85cdb8ee5935ad3a5d5411f3609fcc0b97c6f683d5f61ba9a9dca4
-
Filesize
1KB
MD5175a842b864c4198c92bee3b34cdda23
SHA11f805714dacea31d137c201f31aeedafe51acc20
SHA256eb9dd517f661ace33ae1913206daf9b05dfe7d586ebf14c971d4ffd35f6c935c
SHA5126ff82b8c4f43669995b3ed207a2e4127304b1a6ce386d7b94032a51a54aba40b59e053dc55a49f4f9a0d92c4a7dad33d03cb96ecf9907378eac374111ae056bb
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
708KB
-
Filesize
708KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
708KB
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
28KB