Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
29-10-2024 20:49
General
-
Target
02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be.dll
-
Size
1.4MB
-
MD5
48ed0fa711c99b5dd370d33fd7283d7e
-
SHA1
afc37df20ce5ebeff233832df9e90027589efddb
-
SHA256
02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be
-
SHA512
c6a8e79fc63d5354221e45ea9e2cde1e079f4916f0cb53377b131f3d477fcb3d6650f79cd10fa8331e36947e335c032755027db07916d0c40d55c56553082935
-
SSDEEP
12288:TkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:TkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\aQt6\Utilman.exeC:\Users\Admin\AppData\Local\aQt6\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\aLpggal\rrinstaller.exeC:\Users\Admin\AppData\Local\aLpggal\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\rvJ0Fw\eudcedit.exeC:\Users\Admin\AppData\Local\rvJ0Fw\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD571961a7eab625d987afc3832766798c7
SHA12c2e4f093d6db6051969db6759ae026ddb7e8926
SHA25662ef72edf9c4df98f64ec16a1c61675f7a38db79e7272e6fa75329646213d078
SHA512d596e25faffccf66c2a375960643526598ee92a0cd47845b6155635fedb3523b562558b2c59105d6bfd2670990280876b842896a891fba74293d362b5b1e573e
-
Filesize
1.6MB
MD56dbe4987109acf78b520b67d1abb12ea
SHA1fe1352332912d2e2b27ab135306182547d13ea85
SHA2562d08da3d3e63068dd8db2673ad2e0cae8296797ce0cc500930876d352548dbd2
SHA512042a6e1e2a69b167962a7152d0b59884ab55d73a1756ca8b4af7d73687502f39aa1d790add6b5c5b32d410499051a0f820768b1c83c5ab2224f2eef673a12fb3
-
Filesize
1.4MB
MD59b2604b3079d62189cbd29817a21f705
SHA1b7a0d38afb2cbed9aa36de620eff663161fbbe18
SHA2563fe59b1393267850244f4f29884f7d794377371c0938e39a97a2779bfa3f23b7
SHA512a5c74ff7aaa1853c9fbaec9ad2a994ade6c28a33cedaa3057c70e4d062846ea1eb9ac1489d734fe586f8fcc6b4936c3c6b065d0648b5f616563ab9a3490ae244
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
1003B
MD54a97b4079470dc8d7efd12e7f4df9ca8
SHA1eee8a4332378fc7376b0729445fa9e300bcc89b0
SHA256d023a7dcd202446421af406d28c5ee51341069eff4d4f2a2c8b29975af542be0
SHA5127bb90c200997e47be6e77239ca0c631a44c673f58a254a27bef349f125602aac16528e36add358e5b7f8a2d4cae84c843f0278ff11592ee0744ea9d2de6fa4a4
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
1.3MB
MD532c5ee55eadfc071e57851e26ac98477
SHA18f8d0aee344e152424143da49ce2c7badabb8f9d
SHA2567ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea
SHA512e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
28KB
-
Filesize
1.6MB
-
Filesize
1.4MB
-
Filesize
1.4MB