Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-10-2024 18:11
General
-
Target
c3ec167bc24e86e10581efc8f52840c6af30a72fe312924da4bc3f115ed55756.dll
-
Size
664KB
-
MD5
72dbe7ff8cb3b1c782692f3cc9615602
-
SHA1
7b97c3abc1e53da0d174f5f49bac65b2e005f13b
-
SHA256
c3ec167bc24e86e10581efc8f52840c6af30a72fe312924da4bc3f115ed55756
-
SHA512
cb5f4ef030942e8136626b9a225ef2b2d243dad900b2b196289335c592c537d5289382d25491c3e89bd0546a126ebdda8b6c0eee7dacd713ae155f62e8b0ea72
-
SSDEEP
6144:P34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:PIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c3ec167bc24e86e10581efc8f52840c6af30a72fe312924da4bc3f115ed55756.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\UI0Detect.exeC:\Windows\system32\UI0Detect.exe1⤵
-
C:\Users\Admin\AppData\Local\YJfChbEdr\UI0Detect.exeC:\Users\Admin\AppData\Local\YJfChbEdr\UI0Detect.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\KxklG\dialer.exeC:\Users\Admin\AppData\Local\KxklG\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\ONqYRRGWC\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\ONqYRRGWC\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672KB
MD5d6e0e0b9a8a5cf22c4b590f20f519080
SHA1df302e7c08a4b3fa2a7999b6af1131aafe2235f0
SHA2562eac103ace89444b474ffe78b1719dbfb1acaf7d7de5a33f0eb0f082827e8dea
SHA5123902f27ed46d77fcfcac6368fec81d9d4e6174a18b763ca0164c15fc16c73c11775cd9d9a90c5d55f95b5e5757b217bfd4cc73a14255c9654f50486674667a44
-
Filesize
668KB
MD5bf8b04015929aeb8606849e6cba3abcc
SHA18f2f40e4ff5d0c0fa91f77ace464372691610980
SHA2567816ef8ad4f50585cea332991af52d55655cf6039a8c1f3f6052829b8cc9214a
SHA5126b96a63d31cd42b7188f96a60080a1dc339b60aad4d502dbae58542519fa8d24915ef4667432f935ed3553414ed89b7ee9b81233da90fe028b0c080288e2b74f
-
Filesize
668KB
MD557def19490ff36af59e1b1cde2a1c0c1
SHA1c577230148a2dbaa54d9bc16c0af803381274cbd
SHA25678cabbab9a85a6692546920cef0561ad39df000adaf5fba13672355d94729f66
SHA5126f37882c4cba5ee79c6a1d8b5a0e4aedfe2b33e484a266f37838251cd7530c8ae3410fdb6c2caf220ef035edf56416e530bc3d148678449cd611bdd9a684421b
-
Filesize
837B
MD5f28d14eaab9f5268d85d42bb27ffcc12
SHA1974e25114f5b3387faf3f9f44fe27872aa11d173
SHA256cec48d14d9b97376fb064314c7f259524e753655764f0334090e5d8f1302e779
SHA51261bdb92734e52e133f2486f2a04044c3e55c49068eec9009a85fa03222d0f4f195c29df5bb6f71d7d5314fb4c65e96ca9b1b555ddb850fef3993afd4238b79e2
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
40KB
MD53cbdec8d06b9968aba702eba076364a1
SHA16e0fcaccadbdb5e3293aa3523ec1006d92191c58
SHA256b8dab8aa804fc23021bfebd7ae4d40fbe648d6c6ba21cc008e26d1c084972f9b
SHA512a8e434c925ef849ecef0efcb4873dbb95eea2821c967b05afbbe5733071cc2293fc94e7fdf1fdaee51cbcf9885b3b72bfd4d690f23af34558b056920263e465d
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
28KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
664KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
668KB
-
Filesize
668KB
-
Filesize
28KB