Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 18:11
General
-
Target
65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844.dll
-
Size
668KB
-
MD5
a4f37163b83c99410a7f73b71ac16b14
-
SHA1
12e6ca607d8e87186e39bfbe3997d36a21bbdf8b
-
SHA256
65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844
-
SHA512
fd742a781b4f5b1094cde0a7b1cbf0a48053639759dbe896eff4873f931d748ab556980223a062a1ada0a83d91f7bda51b856bd3ad40f6baabad7ab6d81d5d50
-
SSDEEP
6144:y34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:yIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\65979803048ef965702275a6d180f60a3261af79d3481a928734c2733f48e844.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ie4ushowIE.exeC:\Windows\system32\ie4ushowIE.exe1⤵
-
C:\Users\Admin\AppData\Local\Lca\ie4ushowIE.exeC:\Users\Admin\AppData\Local\Lca\ie4ushowIE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\pRCc\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\pRCc\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\YdHcW7\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\YdHcW7\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD51c7d45b7af9cf818c613e09636b1b6a3
SHA1a2a55b88fd87f94c22884eaa399cb4a70af7fc6b
SHA256ae354227c1071fba00de994613ab2bf626c12f1412af9745ace09a23506a9a8b
SHA512c83c60b2dd4f9cfbaea5e18e7c313801e67b6321834bceb916ac39a7ef79d2247223d54e7a590de6ee562ffba367c4663d62105327ac2740ee783f97378b5bd7
-
Filesize
76KB
MD59de952f476abab0cd62bfd81e20a3deb
SHA1109cc4467b78dad4b12a3225020ea590bccee3e6
SHA256e9cb6336359ac6f71ac75af2836efb28daa3bafd10a1f0b775dcdc2ec8850a6b
SHA5123cbe50a146ca50b0657a78a2d89a34630c69823005668906785b2d2015cc6139c8dbbf7aefa5fe55957ef55ae06e758933b3b41eaf822e49dba3b7700582e2c9
-
Filesize
948KB
MD549afca110badfaea6f15ac4ed474248c
SHA10f31a4f2e6c419bd8dbbef93f5b0367ff23b6c3f
SHA256b7862bdff3c0c4de01583ec6326a283478a7501580e52c18394db9442020c238
SHA5123421477c69adee2977bd9f2fc8da250e737cb9e596c6235392456ac319502e9ae94ead190997120878f551ac92d0f1045ff08fc6c402a8c45caaf5cb19b2e13b
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
696KB
MD54bc53c99539ca15178c6c50187dab4cc
SHA1d9040d06c6d66df340a9e998e43353ee8c32c3c2
SHA256ae5a3dd2f6050fb2652bd26feef638df5ac3eecbc7509f1cc38c7d6842d4604f
SHA5124019ebe471a10fd19bbd109f24dce73f8153398ccbcda93a0c5e4b59fee59c18e5ab58f6fe3ce8e53191f45a7cdbe803130abb4e15a3b1889dac6a8349998a69
-
Filesize
1KB
MD5c6d5ccae63edcba01be1e5abc25aa340
SHA13adf665c633ab1b2e37ef34a9cc45924bbc2f6d9
SHA256ab5a49864eefdcd51f626a9c801c7a272c5e30aff816cdc2db0a65dc6974efe9
SHA512ae6b75f0ac0b0330c4a72d2b9b134950d093baef354df5563dc1235c21dd0aa9523740eeccd7de4411e6170a3537c9d2b338a8669d307bda0a850899edd75b71
-
Filesize
948KB
-
Filesize
948KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
4KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB