Analysis
-
max time kernel
97s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02/11/2024, 02:59
General
-
Target
ff69e56f8ee29f346c9495468b07dc2d2eb486642a1cfcc54d31d7a813bd95ef.dll
-
Size
672KB
-
MD5
584c0aedb20485c2e84e74c629507bca
-
SHA1
68adc01881c74a7e747c02fcc8b3bf6a992595c7
-
SHA256
ff69e56f8ee29f346c9495468b07dc2d2eb486642a1cfcc54d31d7a813bd95ef
-
SHA512
f0de47f3fe7cac1ec434e5e29d33c6ace9e3ee64102acd2f5c05860d782f6c74f34b740ad21615fff80054c9bfa2333492a9c9ed51f182dc3f72805901945e4e
-
SSDEEP
6144:t34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:tIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ff69e56f8ee29f346c9495468b07dc2d2eb486642a1cfcc54d31d7a813bd95ef.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\62NNOfmr\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\62NNOfmr\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\ZdAT\msconfig.exeC:\Users\Admin\AppData\Local\ZdAT\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\CexBzETA\FXSCOVER.exeC:\Users\Admin\AppData\Local\CexBzETA\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD54aae161ecd80053e20603eb54c5e6f28
SHA10ae69144044a5a46fc40645ec91643a31d914f90
SHA2561e7cbe6d3dc77f958afaf8e8008d3ef7e10c2820cde2c7bfd2099e57c3425734
SHA51225e6c146257ed189b3adf355e0fc53ae5968d16f27c0a97d1c7b00b7711857a2bdb0b432df8575b3502ff221d9a2fe45eb1fe5de8b4d1a264bcfdfef5a11e88f
-
Filesize
82KB
MD5cdce1ee7f316f249a3c20cc7a0197da9
SHA1dadb23af07827758005ec0235ac1573ffcea0da6
SHA2567984e2bff295c8dbcbd3cd296d0741e3a6844b8db9f962abdbc8d333e9a83932
SHA512f1dc529ebfed814adcf3e68041243ee02ba33b56c356a63eba5ef2cb6ede1eda192e03349f6a200d34dfab67263df79cf295be3706f4197b9008ccdc53410c26
-
Filesize
242KB
MD55769f78d00f22f76a4193dc720d0b2bd
SHA1d62b6cab057e88737cba43fe9b0c6d11a28b53e8
SHA25640e8e6dabfa1485b11cdccf220eb86eeaa8256e99e344cf2b2098d4cdb788a31
SHA512b4b3448a2635b21690c71254d964832e89bf947f7a0d32e79dcc84730f11d4afb4149a810a768878e52f88fc8baec45f1a2fec8e22c5301e9f39fe4fc6a57e3f
-
Filesize
700KB
MD5d5221ce9452ad142c8e3f05bd82be921
SHA1e4d716c3f9e8900e043f353571636bcdbb5f47ec
SHA256632a51f3b73b5eb010ada4cc4569c6b976f5b4c011ce916006611e266ad1f246
SHA512d27b50a26fa260e321c0c7e80385fbd244ca318e974f7874b519071273c31d9dc95124226c6e26ee9f71176be2ab87f1a03e2ccd5975cb856a7893733e9b679a
-
Filesize
676KB
MD512097512e8fbf55287cf45727781b344
SHA1c195652bee0837df3ba7041b0195349ce9af237c
SHA256ef592109aa4329083cace264978cc42e1f19e644b81d0108726df5c306d5b2fa
SHA512697a9ae0b020264d3448ebd37092baf058e1a708111e5c39966cd9049d51eadcf2dc0f5c66db3676fcd1432f580176093d875a8063185b4a1ba3403fb378e775
-
Filesize
193KB
MD539009536cafe30c6ef2501fe46c9df5e
SHA16ff7b4d30f31186de899665c704a105227704b72
SHA25693d2604f7fdf7f014ac5bef63ab177b6107f3cfc26da6cbd9a7ab50c96564a04
SHA51295c9a8bc61c79108634f5578825544323e3d980ae97a105a325c58bc0e44b1d500637459969602f08d6d23d346baec6acd07d8351803981000c797190d48f03a
-
Filesize
1KB
MD560828e397e83ac7aaf73e36ec7b1625e
SHA1f1b091d04cf9b393d79b757b17dd5721ac6e8d0c
SHA256f72ab50d018cf3de6202af2328b198af24ef12556d1a3d2beae82a6b89c29265
SHA51205cf8cf4c2f8abbe9e1164fdad8c0f3b77e2a8a135fd2194c42edfd689bbf5ad4caaf8829ce4e2f7ad316ee2c94d01a91253d1a48ae8b2fe16b45183a2f0506e
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB