Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 17:59
General
-
Target
c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e.dll
-
Size
672KB
-
MD5
d7b6390737e5cbc33070d66723208014
-
SHA1
d8706c8648e39289dabead6db0f9d5094048bcd7
-
SHA256
c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e
-
SHA512
b168072d2f1c92383f9336484b3cf1595eeba37602718b0a295d1fbacc6255967bacd9fff2090e48570086a104b8f94bf637c2a32ab84a87feef0ede9fa6fa0c
-
SSDEEP
6144:K34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:KIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Users\Admin\AppData\Local\hgI4eMM\rdpinput.exeC:\Users\Admin\AppData\Local\hgI4eMM\rdpinput.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\k5xkp50U1\osk.exeC:\Users\Admin\AppData\Local\k5xkp50U1\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\LaC87fc\slui.exeC:\Users\Admin\AppData\Local\LaC87fc\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD539f02e530573166ed2e93a0fa14c9df2
SHA18b4df122c02b20937b090ad0cce85895ea662298
SHA25692d2f09912b1e101a8d1307bf886a952ed780d0b7135ac4107da33d4479878ad
SHA51278d5471cfc709d942377c72e4395f58951c3fac7afb80399c60daec5947801da731d0c33b8cc296b87e4f599780cebf121d4f66c5fbb6cbb065a50cc4853aca1
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
680KB
MD5d98dbc9913e93df62870cf7f9cda4d5e
SHA1ed2260b5626b45ffeef349ba55fe0ecd7effc645
SHA25646f22cc9ef84497cfdb0dbb2b3b951fe72cba9ce70e50377e9b90f39f65001f8
SHA512a02e559c139bc552c6a2967cdcbbcc628ae80cd1dcada6611c95e8abd5d9fa59cd22833962c62e589a425094f44f3df06ac875373fdba1be9dbdc182bd1ba21d
-
Filesize
180KB
MD5bd99eeca92869f9a3084d689f335c734
SHA1a2839f6038ea50a4456cd5c2a3ea003e7b77688c
SHA25639bfb2214efeed47f4f5e50e6dff05541e29caeb27966520bdadd52c3d5e7143
SHA512355433c3bbbaa3bcb849633d45713d8a7ac6f87a025732fbe83e259ec3a0cb4eabb18239df26609453f9fc6764c7276c5d0472f11cf12d15ef806aa7594d090e
-
Filesize
676KB
MD54be3be79f153d9a568ea76865dd13a3c
SHA1905b58cb5d52b2c03c5b745c03e2dd0f5678583f
SHA256eb52385faa0bae3dbb46732ab28add4302933c635dfbd5a52ef2473e0e43f5be
SHA512c1d3c90089188026ebb68ce57270b4ba49af74505448bd2de9b02166445d12cdc947eeed76e6589d0e3021ec278d15f319e5982dcf1b1d8deceb23fb7480a668
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
1KB
MD521ef0c0d01a3cca37ce893e47094b23b
SHA15c911bc45d5200ea0df4af0676ef78702024aad6
SHA256b6f9521111b95f1890031569ea514a7d036f126de23c6c90b22368547d4fde36
SHA5124928264e2ae52e4667937b151d5839d511274f5361d62ca5d32c190d5454e86680d36ec954a4a12c8e8a3901e1da272f4732985c83e23f605dbf3a454b23f3fc
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB