Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-10-2024 18:11
General
-
Target
c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e.dll
-
Size
672KB
-
MD5
d7b6390737e5cbc33070d66723208014
-
SHA1
d8706c8648e39289dabead6db0f9d5094048bcd7
-
SHA256
c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e
-
SHA512
b168072d2f1c92383f9336484b3cf1595eeba37602718b0a295d1fbacc6255967bacd9fff2090e48570086a104b8f94bf637c2a32ab84a87feef0ede9fa6fa0c
-
SSDEEP
6144:K34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:KIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c5ebee5492b4fa991c1d37e5fee02d92ec9afbe2a7e3397829ad7b57f13ea07e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\WGYEFPVLH\mblctr.exeC:\Users\Admin\AppData\Local\WGYEFPVLH\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\9LDOhwI\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\9LDOhwI\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\ddik\rrinstaller.exeC:\Users\Admin\AppData\Local\ddik\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
700KB
MD5451c79cd6095840232f24c5f3384519d
SHA1c19f9383439ff678e8e6934eb48ce80a57e1abdb
SHA25643c655245074ebd37ce59bf86ec30b1710632509bbb58161b3818d3f73f0169c
SHA512313bad710b535dd9974a9ab8f046ee3fc62f37f924634769e7f4e567d694b1f1df79a52d32dcb96936ed269df6c5bcdba73adc68ed5ebc3e9d2bece99dab6944
-
Filesize
680KB
MD5adc53308df92b480bdea907ecb872cdc
SHA14770c9eccaf7c6b04ed5315765ccbabcaa41c772
SHA2566dfb1ebbbfde182d5715e7d975b57189aab6d4c603c4bbfb51c2d49e64929578
SHA5123592198e931457dab8b80b52a0e147b0551ddcaedc3a91fbee56655fd915112b71def94d4f1e0d163b074403f5b98ce3b7bf725aa75ef1b631943d2c1fdc1cc5
-
Filesize
1KB
MD5a6f98bc2e5a55d754c8d10c504a28d2a
SHA1cb002d43de0b2106a5e760844f0c3ba1aff0a161
SHA2560865ae53a047e1f906c55e1a19eec305fd657c1854f53ece7e37c85ae2a1916f
SHA51201f076ffa1d3fe5d33c1c9e6b979779efb1ab32b5924817557deba152edc5c4c336648fdd24a4af27599cdafdcc1a0f98ed37fe084108e35b5013b6d159cb17d
-
Filesize
73KB
MD59728725678f32e84575e0cd2d2c58e9b
SHA1dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c
SHA256d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544
SHA512a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377
-
Filesize
676KB
MD5c1caf1e2a9615b797dbf1687a96cf894
SHA1d8db212ca5fb92cf024328490e1fa5b1627e35ea
SHA25611b5f13e80813e8bf83d1925b16eb00677cb82fcb66079198660c3861a352c1d
SHA512f084c7536001de7ac247bed43195b47a9c17393268b48ca4b5165060bcc397fb992e570e9ec2e627801fdeb3da86a9244977d665859134af01b5e63926a4b5a8
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB