Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-10-2024 23:35
General
-
Target
db433f70692c1bb245625c99f1860d748aef2021c8918d5f1433ed12a043650a.dll
-
Size
1.4MB
-
MD5
e74399f942cf0cf81df1e8a4972bb8bb
-
SHA1
13416b3359fb3b1ce03acca069454bb4c228b3f0
-
SHA256
db433f70692c1bb245625c99f1860d748aef2021c8918d5f1433ed12a043650a
-
SHA512
09968cb2afead5f2626ed4c85471ffa0b80fab89066e4662dd07f86824a9873f149fa840950123989fe9fdee44649de6f52a7975da6d57ff29094ddfb4b459d0
-
SSDEEP
12288:DkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Cw1:DkMZ+gf4ltGd8H1fYO0q2G1Ahw1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db433f70692c1bb245625c99f1860d748aef2021c8918d5f1433ed12a043650a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Sa3J4OtlF\vmicsvc.exeC:\Users\Admin\AppData\Local\Sa3J4OtlF\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\vJR4T\ddodiag.exeC:\Users\Admin\AppData\Local\vJR4T\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\JUw52E\osk.exeC:\Users\Admin\AppData\Local\JUw52E\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5eb276c3a6935829554ff8cda8d644097
SHA124aba3ff7b74ac8847bf7f6bfaec683df2ee19f0
SHA2565ac8a25df1b0286781b56e03ebd72c3339aecd9eb3b967e453b2bda840b7b03d
SHA5127a41eb07ac4640a3029b557ae4b468b03f2206c41e8a1a9bcb5e5b6f3110e81a9a531c80cd232a202c77b83f6a999278a7dec18a6bb73e7a4cf5a0f8df3cde7f
-
Filesize
1.4MB
MD59afbe4be602768bc2465fb8d1b7fd0ad
SHA12919c7bd4eed0164156011b5d5b3150f3cea1364
SHA2563d2db2189c698f262f7326ed7083e71af24a104357278520af411398ebdf8027
SHA512c02b65da25fcfa5a9b11c7993649d14f29f0df7e79884a7cbdfacda361ee61b54e701a6fd41ec1271041b5bfbf42fa95dd827802266d04e7be4e2e9c6e12d003
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
1.4MB
MD517ad65f37a91ec864b3b40b27028752c
SHA17f52dfe0131ddfe17f58a1b4760fb35e0971c251
SHA25616b5b09f1e4b23b9e648ad021f512c236029dcd7fac2d913498ed15249082b99
SHA5126ec364eafc052edb6cf7c4a4eba7d75ce54c394cdeec5d496394a002505e18f6ee32f077667f4699e255115e3c57407dfde383f4f820b76af10174a9627d365f
-
Filesize
1KB
MD5e5cc92ea83e97109d38f3f48a1e9eef1
SHA1b7f253b49951bc0856f4f80c381d75ae3d8916ba
SHA25649c9ba41b11be4ac797f155de65c6ee4fb366206a16bf8582a76386a8d6f71f8
SHA51230ce93ecd4f630acb76714e2d6e8e1630e255e8082193746023909acd35c6f0ee5d2ea6ed7e0b882363960f5aafb5dcb069bdef57721d39ce11c284019d0500e
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
1.4MB
-
Filesize
8KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB