Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23-10-2024 19:09
General
-
Target
c6ce1e919d846871e82fefd5a57f6a7af4a5e729ee1b9c0f67d4fd71807ef7e3.dll
-
Size
684KB
-
MD5
906ed4f1c15ea3e6cf8d3bc271ba5d07
-
SHA1
897965a6c69be2b105847ee4ab1ca5d704eb53a4
-
SHA256
c6ce1e919d846871e82fefd5a57f6a7af4a5e729ee1b9c0f67d4fd71807ef7e3
-
SHA512
c498880b98d3b4cbc67c0784a2b80426f937ce7f6160f460b01b69b3d2e6cb3e2545fd50ecfd3eefbf3df960e3489dfb2c1c536fad1d32f8e65e6b54925a0061
-
SSDEEP
12288:bfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:zdAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c6ce1e919d846871e82fefd5a57f6a7af4a5e729ee1b9c0f67d4fd71807ef7e3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\d6vwtkMUn\msconfig.exeC:\Users\Admin\AppData\Local\d6vwtkMUn\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\jGgkdkG\Netplwiz.exeC:\Users\Admin\AppData\Local\jGgkdkG\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\kLYxvZ\mblctr.exeC:\Users\Admin\AppData\Local\kLYxvZ\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
712KB
MD55814d12a361cae4105742e470ee0ee90
SHA154dd431993c3ee7f6d1c957ff31d10adddae49ce
SHA256c72ba0dfb481759e8021564639f494e84d86e32f79c4557d84a7c6b276d2901c
SHA5127e3770ff682c6eb1dc07c655fc58ec27552b3c814e51b65ec6dcd3491bd71ee185ab4a51968c97e4d176f14771fdf51cff6331bceb474ccc5c412cfe29a6994d
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
688KB
MD5a9f1425c2dcf354bc740a51cb895cf6c
SHA1e73f754c61c4d19980f3d1382fe0053326eeef3f
SHA25631d6f7fd2d912ba793062a6c3267ee0844605420aaf6efe768923591bf36f5a9
SHA512eee24bf1dc61d5631e7a57f87a17947ffa354a1e85174c96dd59ff18a67bb9fafad580b731b4d739edeb7ef482a9e9b01dfd1a75da27ace6a7eb4c27c60f505d
-
Filesize
40KB
MD5520a7b7065dcb406d7eca847b81fd4ec
SHA1d1b3b046a456630f65d482ff856c71dfd2f335c8
SHA2568323b44b6e69f02356a5ab0d03a4fc87b953edcbd85c2b6281bf92bc0a3b224d
SHA5127aea2810f38d1640d4aa87efbbe20783fe7b8e7f588864a3a384a37c91108d906abd89b235672608c98c46ed76db2b0039462098a1064ebe4108ec37b6087914
-
Filesize
688KB
MD57e84e6caf547e0e23a10dc121990f380
SHA185c4474415857a5905c876bbb6c57b89e8ffe8a1
SHA25675b48fcc5865e747767bf1dcaaec8bec9886cc8d88daf1ada4dc386dd109b4c9
SHA51229344cecfd228d1c60b59ae8d171399b62f29751458cc20c7457184bd20739c08887df1dafe0e1b77dcac9ba0140e35e8b4cc8a69bb0e58d9bc8771742db4de3
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1KB
MD5e75cfe29c91e70ed2425e821ce262b15
SHA11ca9bf793f87439276bc531009abd5dd032bc79f
SHA256fd250b13889607eee30dcfeb1288a84f95a594092c3016204e8c240a820774ec
SHA5123e46d12286cebae693ee1c87cdca9eb67d598ebc706d66c63cc62bbc99a3768fd9ace506b9a69dbf8334e4e41c3268b8b6850907507d6258ced1c4dfd680f24b
-
Filesize
28KB
-
Filesize
712KB
-
Filesize
712KB
-
Filesize
64KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
4KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
688KB
-
Filesize
688KB
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
688KB