Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
29-10-2024 20:49
General
-
Target
02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be.dll
-
Size
1.4MB
-
MD5
48ed0fa711c99b5dd370d33fd7283d7e
-
SHA1
afc37df20ce5ebeff233832df9e90027589efddb
-
SHA256
02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be
-
SHA512
c6a8e79fc63d5354221e45ea9e2cde1e079f4916f0cb53377b131f3d477fcb3d6650f79cd10fa8331e36947e335c032755027db07916d0c40d55c56553082935
-
SSDEEP
12288:TkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:TkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\02381d7d554ad7da5ee83db9cb0de32a4c83a05525750c8a89d8152a383725be.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\Tr5XU\CloudNotifications.exeC:\Users\Admin\AppData\Local\Tr5XU\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\qrBZ\EhStorAuthn.exeC:\Users\Admin\AppData\Local\qrBZ\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sessionmsg.exeC:\Windows\system32\sessionmsg.exe1⤵
-
C:\Users\Admin\AppData\Local\eRMq\sessionmsg.exeC:\Users\Admin\AppData\Local\eRMq\sessionmsg.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
1.4MB
MD53196964e1c26684f7a8d200021f72e30
SHA17653d43127f773504f3ce9c572ebd1f0b7ddf68e
SHA25607a50ca0a4d495eff1c604eb000895f67f0180a2d6e4c5229dcfe597b51b0d17
SHA512986bba2d34565b9de55b6fccae7028622546892d602910291c43acd7f7af8b38b2e8c68604f89dd1af076929a9e82fd33d546163b80af6982385f20b0d06dcd2
-
Filesize
1.7MB
MD5fff6a34127e321775e4fb7286616ea41
SHA1b5626a737e159156b9153a5282b61798e6e59ca5
SHA256e99e4ef4bbd08d4e9fef10679f79726ff8352c39c5436c92a7997a226de4ca26
SHA51280661c8727a1562b8cd7e344efd400848ce0bb9b7c503f5a7b2c6ccb29ee2a36b0cd42d3d5a0b71745b953a98e0cb3a3dc6d72ab319f2723dc39e1c943e1889c
-
Filesize
85KB
MD5480f710806b68dfe478ca1ec7d7e79cc
SHA1b4fc97fed2dbff9c4874cb65ede7b50699db37cd
SHA2562416cd4aa577dbb2f8790a61e36fbab2b30bff81a4e1f67a5151c2fec29585bc
SHA51229d3d234ebc45049a533b6a91b246ac043a56b9af67276aaf493b014ae34d73000f99a6b0c0b85d2dfb7fba54811cf8bbdfd167a9eed01a8617b7f05bf2971db
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
1.4MB
MD502463bf030d8169edc83f93e75f8a019
SHA12a360216c2cbb014d08d4d8b0dc20873ae79720c
SHA25615d8a88c063267fe912a613b8cf974e26485904d9de1f98edcd233ca6ff21788
SHA51242fd602a68c27cf59b07676556937377a3044d8603ec12ac7c2c0270e5db0451b75640810cdbbd7b782dcf71ddd915d130c0e01ffa2e411f567189430d1f0c97
-
Filesize
1KB
MD588036677cd042a744fdfd491f69d7b5c
SHA1292d10ddea54ddf5c43226420ae82cfeeda4a6f8
SHA25655734d1696aeb72aa10711464ccff29598b5421236b0b5a0a5b3167ec13a8de7
SHA51221a4163821e05e10eb76f48cf7038fa47897e585374b82c3f9d3efa435b1295a8e15cad3580f54ad921cb41070351935b2cf45a7ca5e67aef0b3e2fe789116a9
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.7MB
-
Filesize
1.7MB