Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
31-10-2024 00:31
General
-
Target
f4a8f6ec846b2fbe5edf0dc402093eceb69b87819e58953cada2d3c410c1476b.dll
-
Size
1.4MB
-
MD5
16bb8e25d3d2f866cbf6826bb90fd325
-
SHA1
ce86cea88918e556a9d0d2061c332da8e7513623
-
SHA256
f4a8f6ec846b2fbe5edf0dc402093eceb69b87819e58953cada2d3c410c1476b
-
SHA512
53321d6e37c9be3be9970ec3a69d84c049e022d071e47a03b922149b453493f531eb4f2afbaee0110d2ba4b87414c653015dd7f85d31fb41848063891b6bee72
-
SSDEEP
12288:TkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:TkMZ+gf4ltGd8H1fYO0q2G1Ah
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\f4a8f6ec846b2fbe5edf0dc402093eceb69b87819e58953cada2d3c410c1476b.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\iPoW7ED4R\perfmon.exeC:\Users\Admin\AppData\Local\iPoW7ED4R\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\Thy38VXL\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\Thy38VXL\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Users\Admin\AppData\Local\0JKap\printfilterpipelinesvc.exeC:\Users\Admin\AppData\Local\0JKap\printfilterpipelinesvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD506a3530282313317b533888f794a2379
SHA1fd53d00a39d6874c6d55f8f82fc71d842b56b950
SHA256f9b0d4dd29cfbed08226548d58bc802c0ff880c6ee7bc201710427d2728014be
SHA51276c662961d3f0a13005691b018736234007a2e12df4c0fee07add874a0bcdb4406cb2b61df997bb9728999a8d4e55c4c8f4bc201b48329a219a4d4326751f58d
-
Filesize
813KB
MD5331a40eabaa5870e316b401bd81c4861
SHA1ddff65771ca30142172c0d91d5bfff4eb1b12b73
SHA256105099819555ed87ef3dab70a2eaf2cb61076f453266cec57ffccb8f4c00df88
SHA51229992dbf10f327d77865af5e6ebbe66b937a5b4ad04c68cafbf4e6adbd6c6532c8a82ac7e638d97c1f053353a7c8a6d7e379f389af15443c94a1e8f9b16be5f8
-
Filesize
1.4MB
MD5992786c25cc8ee99584703bb49f023ef
SHA1ea187bd672bf7c56b72fd03f14d13c8f9cfd42ed
SHA25608674f213a1e86e8da9b7e6f2faafa41d80de5096f917a1dbe390b45fbedc1b3
SHA512d7100faf6deb6681653a372aa6b810dc2dc33e8e57c3852d1c48219662120b633ec38dce2b8403e3ce9f97bc0355a9e59c10de96af57082636b1294d475af8d3
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
1.4MB
MD519af7cd37982a4e430e479ba0bf68880
SHA1330db9a3c5cac1f885182d21731a9b80047171e9
SHA25697f954bcd8c286c44d2c014ea8bf8d06ca2dc8e291982727438a9d3014100be8
SHA512449b91316aab762a8e6a4cb97c2d8a85e34fce35ee05b785bed51896b13ac3efc3ba963caa8d8e1a0060f0e7d1aa621bd93bb0dcd0eb454d0c8c1c83d9174367
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
1KB
MD5d13d6103feafe4e9d37e2685f0222f87
SHA194f53da62c1c0d078e64500a3ec2d939af8212db
SHA25636e2013e04fbced9497e032835be5c17a64ef62d35ecedcdf83195c29912dece
SHA51207dbc1ce4471c13573d6c607ab6b21eb1206d3253e6908e9e261bbebc93e6af635202a9a4c9d614f094ef9a60b9f3f2696076d7d1dee817594c02786a30498df
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
28KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.4MB