Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-10-2024 21:23
General
-
Target
d5e632ebe0a5db834a209391c2ddf1ec91aad99a19e177d68daa51998b3ace26.dll
-
Size
1.4MB
-
MD5
460853dc2d4eb8c6ef969468e96d4848
-
SHA1
1cf879eaffda5e86c10851318b6aced388609191
-
SHA256
d5e632ebe0a5db834a209391c2ddf1ec91aad99a19e177d68daa51998b3ace26
-
SHA512
481935aaf938dca27ff8fc91ea0d905db8c7d9036be72e2ac5eaa449ddfde7a8d074f9d20d51a11a1f850d11730c9f2a0e18ca3bfa99ea2455b573a45cd2182e
-
SSDEEP
12288:vkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:vkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d5e632ebe0a5db834a209391c2ddf1ec91aad99a19e177d68daa51998b3ace26.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\WZDhyS\wbengine.exeC:\Users\Admin\AppData\Local\WZDhyS\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵
-
C:\Users\Admin\AppData\Local\1D8ZnD\wextract.exeC:\Users\Admin\AppData\Local\1D8ZnD\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\Vjn\Dxpserver.exeC:\Users\Admin\AppData\Local\Vjn\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5d19e456184953cfd4e3522cd86919ae5
SHA10fd65552d935d9dd7c0a3f1de9f20a2615a059c5
SHA256e00ae1fbee9569ef45dea95aa3e729524c4593076c04bfd273edd643a91defa7
SHA512f0cd204369690496a400dc90bcdd407b28879ce8b006a7b9dcfdea2651396d3b0567768cfff94dadd4b35e6bd1dd92e203adff93b4f8a077f1b4b225056e3def
-
Filesize
143KB
MD556e501e3e49cfde55eb1caabe6913e45
SHA1ab2399cbf17dbee7b302bea49e40d4cee7caea76
SHA256fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0
SHA5122b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
1.4MB
MD579dd52218ca9da19f3ec2e2b06d2aa2a
SHA163b95a02a4f5fbdd8f8c50f2d9b94f4e858bc505
SHA256517687b7d7c0a6ec33eadd05515cd8d2f7506dc2371906e18f253d3af6587fb7
SHA512568ffe911c3c7512e204dcf17b788a9879c3bfb04672a2c98426cf6d03e45db8f92a11141a60831093b50719c4754059c40bcea134b67df6b356111f4ac3b9b2
-
Filesize
1.5MB
MD517270a354a66590953c4aac1cf54e507
SHA1715babcc8e46b02ac498f4f06df7937904d9798d
SHA2569954394b43783061f9290706320cc65597c29176d5b8e7a26fa1d6b3536832b4
SHA5126be0ba6be84d01ab47f5a4ca98a6b940c43bd2d1e1a273d41c3e88aca47da11d932024b007716d1a6ffe6cee396b0e3e6971ab2afc293e72472f2e61c17b2a89
-
Filesize
1.4MB
MD5ecad6fb9628048ab63e1980af6c0a09f
SHA15993f63851c97ca461610b00cdfb44fd0f3abbe0
SHA2569b130b142648c62464f3c8dcbf2cfff23c8b4059f81c568cf91f0fffe9a3094c
SHA512958610fa5c5fa2cac43bf60e0a6a78fd910dbaa3a36fa7bca7aa5534b3b53ca91d473c23838e1ebabe3d19aff1c1e172c2f754d5846ca796b01ad8bb5c174074
-
Filesize
1KB
MD5b04a87df2ef15113b7c6072cfedba90f
SHA139e6071dd54e7ec47322401fa443844e5fde0032
SHA25649e384cd6a686f89ba3da51da49cfb71b11cdfaf4e7cc332b0785cdcc50b7dde
SHA512b2426a8594e10f43cb14421be7d06d80310c0d88cf64be85bdf217f2cd1e51148a2ea1ac6993efb41c4322a904d7f0e5ac093581cbe40b6860c145f987e06fc9
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB