Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 17:59
General
-
Target
ff4144c8cc33129e3e51eb87174bb82e62597373df4f0a70832d3a598b473b8e.dll
-
Size
668KB
-
MD5
68716a010cc7093f10b36d0c886ae030
-
SHA1
75ffb8693bcbf4cafa0fba09a5302f2e0f2c1df6
-
SHA256
ff4144c8cc33129e3e51eb87174bb82e62597373df4f0a70832d3a598b473b8e
-
SHA512
b33b8fcd34e3a96097d428944e886d25dbe43638e098d45dbe1d883d144ff3398a7877b6d3915a19298294c2b3b1029faca642ebf41223ad63e6d0fea827c406
-
SSDEEP
6144:834xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:8IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff4144c8cc33129e3e51eb87174bb82e62597373df4f0a70832d3a598b473b8e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\YVtFez\DeviceEnroller.exeC:\Users\Admin\AppData\Local\YVtFez\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\zou4It\msconfig.exeC:\Users\Admin\AppData\Local\zou4It\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\ZLdWZO\tabcal.exeC:\Users\Admin\AppData\Local\ZLdWZO\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
672KB
MD5d0f2ca9c98a3d852bc14cbd6c1bee2a3
SHA1a1b4726613fb6a1a5b3aa5f4d750582a8699da0c
SHA256b9c038c46d0198f15b374d20759916083b44896d8af6846b82c094326d0b457d
SHA512d1e6c6d046f7329c5f17ea58de68cf60629d5df1e889ac00d05292e9ebb1e6df80db78479c19c8657852ef92d05b1b37eb91894721b2d91bcde870740cb856ae
-
Filesize
672KB
MD50366b7e85b50907335e8188644501268
SHA113aada52e7613424a683a0aed2b6194dbb31fd39
SHA2560d88b21ff5722302e38e354e238a895b83f7a930572da6e15c939c1a67f025d9
SHA5128d8aabbfadeef91b93ec661d0aee02aeab4cdda5d573c21e9c760520ef66708f542004b9caa0f40deb4e1f1c89d18dcf0d4647faebab991155e1acc3b7dd978c
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
696KB
MD557eb57feb27cd21b7e45cb751ec05561
SHA188e69fd9fc5862361054ce4f335366e6c4b38e39
SHA25698ad9cbfeff7b7a39d1638d7bb4a5cb7c65d72a904457ffb9eb42f873eb8fccd
SHA512b7d331ee1c139b2350b5c74c9104517063d6bb1488c40721898653e696201c2a73126165de8e3cc5bbd12348e59e24e61767369db4f1707fbc64113a61cd27f7
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
1KB
MD55b1a7f77f5c988f7b110d21aaa5ea1c4
SHA1d0723a5f153e41d80f9815f24b9137d5990e04df
SHA2563f4c6d0017cd3b18e8742ee90f807da7d388c0bd41fa250c7cdfe78234405b2e
SHA5129f58a95ed169c9edaf201ac8129e8509aed69a3a562046afff070135a2dba99bd67b6c8880638fed30d92044e31a8f73ec8ba1a032ab2426de0940797a5b5bcf
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB