Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 01:03
General
-
Target
afba02c33a5c421b7cb7fc7ff9f99d8160a785cb259a688fb75e8c7fdce9931c.dll
-
Size
944KB
-
MD5
01c459593f35851fbb479c78490572e5
-
SHA1
3e1d026171828708e4d6cb4063e7207abae41353
-
SHA256
afba02c33a5c421b7cb7fc7ff9f99d8160a785cb259a688fb75e8c7fdce9931c
-
SHA512
1ae6329f54eec7984a23dae1d400bc73d9e36fcc73489c17a4f0b2650cf1b846c2a95fab49bdb9f3b4e52ef4ff84a359f2d20523169c548aacf67724b2402bb1
-
SSDEEP
6144:634xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTK:6IKp/UWCZdCDh2IZDwAFRpR6AuoK
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\afba02c33a5c421b7cb7fc7ff9f99d8160a785cb259a688fb75e8c7fdce9931c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\99BhBd\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\99BhBd\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\2zTqFQV\wermgr.exeC:\Users\Admin\AppData\Local\2zTqFQV\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\uWw\cttune.exeC:\Users\Admin\AppData\Local\uWw\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\VbOelx\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\VbOelx\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
100KB
MD58ac5a3a20cf18ae2308c64fd707eeb81
SHA131f2f0bdc2eb3e0d2a6cd626ea8ed71262865544
SHA256803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5
SHA51285d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b
-
Filesize
948KB
MD5b45ae9c4f171ecf1f89d305705d236f1
SHA11e9fc018a7091deb51da16c17fb1c358283c438d
SHA256977eafbed1afcc865422701068bf25bf8fc11e29a9be3f52636ae3905dc91630
SHA51259b0ac44a1dfc1793c7f046df5d83ff71d885ddceca45c44ae6eac87bc01b0286b8e457e4209feda4bcb54c5d7fac0545ca74675042d1a21118f89ebeca12951
-
Filesize
948KB
MD5a0fbbf15264c438c7dbb05c0beb8d64f
SHA1785cfa906f7122e6c7b82593b53869a5d3fa1289
SHA2561ec6197310d8eb64c526d2a7f64cacad865cea5ad05dc6b8b7933d9b99c62412
SHA512b07f093d2af79b7874ffe582a1765cfe0b860626b1b021ab5c6745580ed38542ec4e9f60c91b0856c8909e2cbb56d7e15d7cfd5ee188640b9acd2d95f2c7a3a3
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
948KB
MD593fcebf687dffe52b5258c3e7b02fdc2
SHA1146d370b13acebe27a1ae5e2323dc38ed9341b7d
SHA2568439dc556944f1264cb68010f83964bcbb58267f8565f044b2e773601bb28ea8
SHA5127827b9604938995decdbb8b1f8dd54b23994687fde4bf82fb8a62d26fb016ca5a3d854e4103fecd5eb3b3a8f0c6f3626bd095009e11b9408513d84407ed7598d
-
Filesize
90KB
MD5fa924465a33833f41c1a39f6221ba460
SHA1801d505d81e49d2b4ffa316245ca69ff58c523c3
SHA256de2d871afe2c071cf305fc488875563b778e7279e57030ba1a1c9f7e360748da
SHA512eef91316e1a679cc2183d4fe9f8f40b5efa6d06f7d1246fd399292e14952053309b6891059da88134a184d9bd0298a45a1bf4bc9f27140b1a31b9523acbf3757
-
Filesize
1KB
MD555216c02280169abc4911ef291736e59
SHA1d0c3191fd9388d8fe2aee2ffde0abbd9d1b0cb31
SHA2566d7198e7be9e9e0c7c55619e5dc4bd4cb1706742bdb635175637e28b57b8e5a1
SHA51260d1bec6f43891e5ec5ec527b63abfcbc0cbfd3fd4d3c4a5630124901b7bfb2f278822190d6b7fb3e6c9eef3ce4cb881c74197ebe21698569eda6c3f990ac6e4
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
944KB
-
Filesize
28KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
944KB
-
Filesize
944KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
28KB