Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
29-10-2024 18:11
General
-
Target
65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844.dll
-
Size
668KB
-
MD5
a4f37163b83c99410a7f73b71ac16b14
-
SHA1
12e6ca607d8e87186e39bfbe3997d36a21bbdf8b
-
SHA256
65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844
-
SHA512
fd742a781b4f5b1094cde0a7b1cbf0a48053639759dbe896eff4873f931d748ab556980223a062a1ada0a83d91f7bda51b856bd3ad40f6baabad7ab6d81d5d50
-
SSDEEP
6144:y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:yIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\ffL4Pacm\eudcedit.exeC:\Users\Admin\AppData\Local\ffL4Pacm\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\cbYwWJf\mstsc.exeC:\Users\Admin\AppData\Local\cbYwWJf\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\yYDZmgItY\rdrleakdiag.exeC:\Users\Admin\AppData\Local\yYDZmgItY\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD532eec443f616c8c7a0443856df682035
SHA155b6da996012ea42c62e7de68e7c7d80044ac86d
SHA256af97a0973dd890c7b3168f77bf9a6d4a4b6f543015b5246ff7a49b2940d679b6
SHA512a65f0ca409e5fb5180eea6575c8b48b068b87d0c42417deb89bfb99bcc5570e6b058b80d08f80034bbe554cb6381a85ac307cdef639f19ef644a31b32b355f6c
-
Filesize
696KB
MD52dcc0336e5a0c85bf69bfa3aaf452149
SHA1cbf15d7eb620e7c743f147e6301c76c8f3cac6dc
SHA256130b91cf688e4f2d1be9195ee6c66700d3db9f9c09dc416936ba8689a2c65cdf
SHA512c50e2b804be52de95dcdec2b8f102fd213a8e9fa42c5563a6e61bb0a9336d811a7fdf5639b80ffcd92a9f6697e6b99fb0ef2b91954edc175ce0848f39e1ac10e
-
Filesize
672KB
MD53dcc1d96a4036921bade07424eaa6116
SHA1611d898a7e5752fe2a659d1f4169d50c596721ae
SHA256bb0b361f018c43f0dc5fb36d711256e2f0c638ceb4e54cc73a791213571ada1f
SHA5129bb30812cc3695b639cfa304088b2c00dfbb01d028811f6afb8d95566734d6d77afd6352fb8c32dba202df790858190040ecb89b4c21767cfec1e3bea1a51f39
-
Filesize
1KB
MD5799c56f38b7ec2bf8717523c17c2f41c
SHA1e6532cf4afccf2f439f6272a02db2ca9a4a2f3fc
SHA256d89b8756454e9479553d51e81d3027d468b7a3237bcb6d592ed9badd679737de
SHA51206bf2d767551b144d46458e61422d689e4ba71e5297b730eeb5e738468c77bb297106548112b4951befb8f304ee628170b84182bb13b03d377f697fdfd73c602
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB