Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 01:03
General
-
Target
c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69.dll
-
Size
668KB
-
MD5
d5bde9d671851c1400307e33309c09a9
-
SHA1
381365bd2fdd24f20173279728db8dde2331115e
-
SHA256
c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69
-
SHA512
334e82ab5397434cc861ead66aff1456898386ca864711fbbcb791d6e4133b78dbfed5fcb65e07f45d885fb394830262bbdc271e949ce7572c70311a35eb14c1
-
SSDEEP
6144:m34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:mIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\EoCV\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\EoCV\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\OKPSW\wscript.exeC:\Users\Admin\AppData\Local\OKPSW\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\obJlLxw\rdpinit.exeC:\Users\Admin\AppData\Local\obJlLxw\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
672KB
MD588fd2bdde2394d929fa03a94d1f780aa
SHA1c5d14be174fa99e01e06b86836491c73e21aff3d
SHA256119b71aff3ee478cba75bfbd0084cfcf341886c7263974ae838528c02a0b5ed3
SHA5121294508791153fc1bfd86c04d470a7c2156b3733b0ea7ad9eded3ce672d2b40bb346d9175d0b460633fb803a4f55dd1b8ff8a1a7c07a862b62ca2da13ac42470
-
Filesize
672KB
MD5da69808c6ee462a2adfc19c482992ff6
SHA16821adc3f24eed283d7a13ecc74ceefc1220fa6c
SHA256dca36f81e43376af01de8e7685ee530c84d301906414115ee418fb976775fec5
SHA512b27dd3bb1389aee471a9f30620d4163fc7aff1eaf1c3cb67c5e0dec187f8f59c6a05cda8a4154f60646d117f909541312a6b39775d3621268d021f4819b88ddb
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
672KB
MD5416afc2c9588fab6f145dc757d88d7f5
SHA1054538ab15996c796ff8d466099d2702ad1cc4fd
SHA256ab4b2a3d3f8f5992dfdb503b319059cdefdc0ba0978963b137fea0e9dfcfd7ed
SHA512873e40b4ca7074526d6f23ab6411fde49cbd81b664b3997b1c9d859984b4fed026a970b51e33a5a85b4bcbf1864a336e6c466d6999d0e594fa5da0d250b5329f
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
1KB
MD54ef726a439a7370e7093abbbd03fe7ac
SHA10d203c33154ff97595678de6cc15b5e47948b4ab
SHA256d851e6b2c0e1b1ec8d6df4cf8516599dd6334dcf2e6000cf2167a19f121ea924
SHA512d2d928f3d3d0e73bea5199d4add23d1e7792d90957d9ef0ee8abdff989c4038cdf9702ccd466c0f4717871bcc892929cb839e5ddd3d810b007958f920ee1cfbb
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB