Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 18:10
General
-
Target
a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763.dll
-
Size
668KB
-
MD5
f1fef96e70f11bcc6f67cb15fa1d2220
-
SHA1
981d5a3fe6ed1b02bdd9dee4daf3d4777b17dbb2
-
SHA256
a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763
-
SHA512
34e7dcb270ab5cd8838c5fd036fe2fd060619f18ff33a1803e5aac3a5fedb198642ab051f8d63a9410ed8864e0ea2c2cb1c0fb968f9abed72e2cb954d1fb5258
-
SSDEEP
6144:+34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:+IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\C05z2WJ\Dxpserver.exeC:\Users\Admin\AppData\Local\C05z2WJ\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\Z19Ax\iexpress.exeC:\Users\Admin\AppData\Local\Z19Ax\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\N0X\FXSCOVER.exeC:\Users\Admin\AppData\Local\N0X\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
672KB
MD52a95df27269da8e5b5618efbd89d05af
SHA1ba5abc3cce527ae254b6517abd30108537f00152
SHA256d69251389c470947b884e6aaca90c7086f0af24f9b1bc739a25d53a8c55e65d9
SHA512bc25f4812de86462f408ab4060b8dabc6646af05f5f632f2967df0f5519e1e30f4208a3415e841b565a93d522f5ea43c3452b100b27708a3051b006d21a96433
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
696KB
MD5ee978407041265ee40392d3f2ffe9195
SHA1c3c25a1301df329095f2f9e2d1cac08e1cdfb7b2
SHA25653aed6fb4d6a88efe675179e38515e909887033e75c52ba2dbc7906ee940f863
SHA512259930c98c027c4117e437d940e483275cc613273725353ffed657a9c07cf51097b7c30787b1a94d8a195cf22de258f1e5d65a737b591210d5e6a77113b8b4e6
-
Filesize
672KB
MD5d5587cf13e0dbc28c7539262d349dab9
SHA1eacb2ea9710f6be0bdb6db2ff4b6a312d774deea
SHA256158b414d50ebbbc5c8263131a3eb49bab391e0ae9c071e6b34485e7194bbb175
SHA512a5021371179c05fa9d1444b105eafe4788886a9268ff2fef883a0d113648dca1179a8cb1ff2ea971f9febf55de3b6a03aa2316ed01c5457248659711e1ee787d
-
Filesize
166KB
MD517b93a43e25d821d01af40ba6babcc8c
SHA197c978d78056d995f751dfef1388d7cce4cc404a
SHA256d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3
SHA5126b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391
-
Filesize
1KB
MD5ac1330a4745944127dba688d5d28403d
SHA1b6783d091a015a34f119f770a4d6522e3443dae2
SHA256efa29a31ba9702c11f372da22772e7ecf0b91cacff8be754468dd90e3b5fd611
SHA5125d61285a33ccddc8a89bd9c020d63ba089f8472fd5a45d1c2d15c0be3a6e692d10dd28db320264864cd72a817bbda907bebb9ba125fff22e6cf1ba1ab99e01c8
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
28KB