Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-10-2024 00:14
General
-
Target
4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll
-
Size
700KB
-
MD5
bfbcb9e4b4723629dda33d1406a87d3a
-
SHA1
d342007297faf30e3cd1a703b31287e735470858
-
SHA256
4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
-
SHA512
d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41
-
SSDEEP
12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\quickassist.exeC:\Windows\system32\quickassist.exe1⤵
-
C:\Users\Admin\AppData\Local\D0Kt\quickassist.exeC:\Users\Admin\AppData\Local\D0Kt\quickassist.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\9zA8Cqc\usocoreworker.exeC:\Users\Admin\AppData\Local\9zA8Cqc\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\PRTQW9q\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\PRTQW9q\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD592b265726eee41ec42569e4c27f0d186
SHA1ab12316f8f3c3052fdd58ebf205f42848518332b
SHA25624d40311f2e8ba84bf05fd18fbee78efd476d20ad17f4f10d7079e286a36f29c
SHA5122fcc0c39da23b9948a901b070d32f631804f45b2c0978a6738e2f61fcdf8c83694d14d13fa4e8fadcdc457c05be05f1710f92c975e36930bdab07e655377f4e0
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
704KB
MD558e0eb27a532bf355004b8fbff916991
SHA1111d0e80fbbfb80452c30aebd8887ec6d8ca289d
SHA2566aa14728d23fcb33d3184da5d013869570d01475f4c486e8d39b46914eb8d290
SHA51245234ea0a638db74caaf38ec60e83b1b2f7cc54b570423cca293b8e574079e8b6146f183172efbf67af63f293f6739cdb88f04bc1f8c74945957c84223deddd6
-
Filesize
665KB
MD5d1216f9b9a64fd943539cc2b0ddfa439
SHA16fad9aeb7780bdfd88a9a5a73b35b3e843605e6c
SHA256c1e8fda00da574e8759ba262d76b6edc1d5f4a80620730ef0be7527e0d803db2
SHA512c5fd7d81d1d478056fcbed0ba887ce551832f0104e7c31753c3c8760b4d63f38324f74e996684042acc8f9682fce8a8c85172741a868257e87d5e0f988c4e567
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
980KB
MD5290901bfe64ffdbe1b3940ab43a56a00
SHA16c9eb7703fd3872a3a5f15a5084c656a540c6f26
SHA256f02ae93ba8ad9fe306721bcbf469730f1a248a7ebdaf4958a8c0bf99a5798a92
SHA512805de588d3be2ecc374d13b91925a9deb3e747314a39815535fe809832a94245b994ef7b411cffa216a5295b879c96086b1bbed12e54908ef403cb0a7592cad3
-
Filesize
1KB
MD56bd4d0ab2baf67f75a3cff999259a474
SHA1ae545c56d639d9f54663521139bcf176195fc660
SHA25678205aba6af28704ca9e98f457f31d724369f8f4e3172b43a4100901ef09a5be
SHA51263f912759be73747af4684f9307357c580b8abd86c858be44e719a5745631f7961368cb78bd01a7e87c77818a9547792941d8629f5bed751cc9736cd5949a0cd
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
700KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
980KB
-
Filesize
980KB