Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02-11-2024 02:59
General
-
Target
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll
-
Size
676KB
-
MD5
3a326af7f81639f667ee14de69537a21
-
SHA1
66c8fed72543d4c155411dc08dd21e615e2dec8d
-
SHA256
a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
-
SHA512
15c4efe13cfedba6e9def41216acb062cae4ae59338c1878ce97507c980b771c2b332d34885ece2444e0210e7f21e79cbbb57ecf1a111e3e0f8939749c27de4f
-
SSDEEP
6144:R34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTa:RIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ComputerDefaults.exeC:\Windows\system32\ComputerDefaults.exe1⤵
-
C:\Users\Admin\AppData\Local\0Pad12uB2\ComputerDefaults.exeC:\Users\Admin\AppData\Local\0Pad12uB2\ComputerDefaults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\i5WM4W4\cmstp.exeC:\Users\Admin\AppData\Local\i5WM4W4\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\YIU\unregmp2.exeC:\Users\Admin\AppData\Local\YIU\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD586bd981f55341273753ac42ea200a81e
SHA114fe410efc9aeb0a905b984ac27719ff0dd10ea7
SHA25640b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3
SHA51249bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
90KB
MD574c6da5522f420c394ae34b2d3d677e3
SHA1ba135738ef1fb2f4c2c6c610be2c4e855a526668
SHA25651d298b1a8a2d00d5c608c52dba0655565d021e9798ee171d7fa92cc0de729a6
SHA512bfd76b1c3e677292748f88bf595bfef0b536eb22f2583b028cbf08f6ae4eda1aa3787c4e892aad12b7681fc2363f99250430a0e7019a7498e24db391868e787a
-
Filesize
1KB
MD5a76f909deb53bfff56ce5a9408299756
SHA185acded586b3eabedee6a4c98b7ea17f9df60088
SHA25652f5370b05039610fec6a5e7395309b314fb335b9809d3529d73f605b989a70b
SHA5120ad292aaf118796e9d37586f6cf0fb2c3ffabc6835b8f3c405dd2de1689371db0e946896c8af4941c7be4e88d6cf96056e6df11fe5aece4f7d8e95d825d3234f
-
Filesize
680KB
MD5e1c4aa8b280764364e51ca50376be21e
SHA10b2778b02c24d35fcbc5aeab252e6c6dcebbecaf
SHA256622a831897cd831aa1fd1f670b85cfeb7e42ef985f0a56d028b596774a2a3710
SHA512656243cf5608827db84e1692812659826e18658e5ddf704801dbe5fb12623ffe2acd434bb0dcd389ce9a42d9048439c7908c87479a09253befed638d6f924e7f
-
Filesize
680KB
MD54f86a7473c65f40813af32eb973e3670
SHA1bdb742da006155734705e00a5b3ae31793f8e871
SHA2569bf9cc100211f9b402d46e9840780dcb7bc9abaf4b1aebad090a948858c91e68
SHA512c47c8c48bd2ca25a5ee6343ce513d22338a54b0092d37de0412291ab2c2e6bc5a3443beddbf46bc8b9b5b9989fec0517e4bc999b8a37c57e8cf2673e71a7a8dc
-
Filesize
680KB
MD5e37f7e1967b3935be1b9f247ace0f490
SHA146c36b1e450f69a0e008118be0f1103b538bb070
SHA256db534f36d896080a384a9a186ccc140ae1d127c63382b65994b1088e23078326
SHA5121344405291f1f1a23d44e31fb55d7ae5aa645d5b798b4d5af46d8e20024741b286ba83d8de4f83668d7507eb4536e0e633b3d9ad755c13e2080705e669d22872
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
8KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB