Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-10-2024 00:17
General
-
Target
4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll
-
Size
700KB
-
MD5
bfbcb9e4b4723629dda33d1406a87d3a
-
SHA1
d342007297faf30e3cd1a703b31287e735470858
-
SHA256
4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
-
SHA512
d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41
-
SSDEEP
12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\JMUIVK0\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\JMUIVK0\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\WtBU2yjf\upfc.exeC:\Users\Admin\AppData\Local\WtBU2yjf\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\bdeunlock.exeC:\Windows\system32\bdeunlock.exe1⤵
-
C:\Users\Admin\AppData\Local\crYpAGNEX\bdeunlock.exeC:\Users\Admin\AppData\Local\crYpAGNEX\bdeunlock.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
704KB
MD5ab0b6d4004fd45b3e7ad85514478d267
SHA1bdb39e869a662f6d39f6c1a493fd7e8e5478c7a7
SHA25681abcde1c46e8fb7ba97fa0fc7167ba4a8e2f316e9096e851424d21fa99c817f
SHA51203d7c5c3405acf24db564ff645df40b4abcf47a7d350b842dd42ed19ec1d1a1719955df78ffd06130844ee5662feecd68c79ba21c8fbbde90446ecce435b2f38
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
704KB
MD50e915ef7e21e121b581f38e02e64ffb4
SHA112f993b42d0d261004ec07aad1002ca8b404a0c6
SHA256a4c2ae7f42991b2fedf210779e1edea8332f21f48194a9f586586423212689e2
SHA5124a5f027190c865facc38840f2442bbc0497cb225a7782b05a32b97291d5a77d70bdc921a84488868d5e91e7745e19c7bf7051566e1131d194870b9e1d9e9a077
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
708KB
MD5c8ae83819532b97d84ceda8ac307bf27
SHA1fb148f0752ae552060e84fcab9a83f3265922942
SHA256de1e18d588756901f3077b0fccacdc747938a6e5da7227f8077c4c8bd4f18230
SHA51270d671d24fe8e94f6e88ea26b31051a40744d2a56bc2849101958f7947be8886ad6fce6a4aec323ad44a30a4e56ea0ca53aa36b3eb8ca28e135edfd418888ef9
-
Filesize
279KB
MD5fef5d67150c249db3c1f4b30a2a5a22e
SHA141ca037b0229be9338da4d78244b4f0ea5a3d5f3
SHA256dcfdd67bf3244ff86cadaaea50b43cce5479014ea2021c0c2fb40b7c856e5603
SHA5124ded9ca87d9d30c31ab2baededaa6e26681741ea1742d80c318173536c643a01bc049e03a03c3b45b3cb8860464a855830e12e87670503e65eedcdd5e9b2d1e7
-
Filesize
1KB
MD5262a6b9e50423cae4fda7ba51c6ef8bc
SHA1065aba634c66f8360031ea8adc4ad9fcfe1a8012
SHA25699d40cfa67a4d9d070f044d2dafdf0814ac15383d839d45cc9509e6ba613d3a9
SHA5126c166be9e612d7338f19fa3feeb5717b513de77bc798a575587cc148b584ae6556539284711be410d86a3c85fb0d2fc1f64fe799697126a5a7236009e656c6b5
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
64KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
708KB
-
Filesize
708KB