Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
02-11-2024 02:59
General
-
Target
fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58.dll
-
Size
672KB
-
MD5
089bbe4454e8a5806c2c27247bd47c3a
-
SHA1
837ada8cd4d906788c34507cc413a78389e91c02
-
SHA256
fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58
-
SHA512
a789910c2cd0698cd0f383ca4bfa2f54b8c11c640aa74d632ccaf9596c8353c319f0b05612b7b590fc860eaf131a7d783f1ed735f82975e7d77a3332154a937d
-
SSDEEP
6144:534xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:5IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\spinstall.exeC:\Windows\system32\spinstall.exe1⤵
-
C:\Users\Admin\AppData\Local\AYW3qdn\spinstall.exeC:\Users\Admin\AppData\Local\AYW3qdn\spinstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\nZG\tcmsetup.exeC:\Users\Admin\AppData\Local\nZG\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\5aPb238Y\fvenotify.exeC:\Users\Admin\AppData\Local\5aPb238Y\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD500e45c2250a45916e5de6aba9ab457c0
SHA13b4725d7090b7f8287faaab9c8ac45d2d2f258d4
SHA256f074f950c477318b11d0d3cb4dde6247a3b15d75139dca7d49cf406d26dcbaa2
SHA5129715177b78190bf9e873517d7cbec7c75e516987d5d18f471a89406963d5cdbdb70c8dee0f5664d8dc96beac22b531b2504f98b75e8168c60afc3d0ad67ff5e8
-
Filesize
676KB
MD5cf7cc4ea48b235e00d465959a5955509
SHA14786864606aeb51e35e008d76f12d87f6572f047
SHA2561096c8478a9c42dbc0bd3560272da086054cd1b4e0d6fa9b1d8437f47b0ed12c
SHA512d82dc17064f51e56f969c1c0601beab817ad9fd77a5af19aa9272662e7b2aa2f2178295e838984b010eb53a7e5902c85ed7e33333dea585ed67ffcee3b98d8cd
-
Filesize
680KB
MD5324ef7fe47dd37905184d5fb3f59fc4c
SHA17b1ea58eb4a78382cba54549f5d7ae0d178a9e25
SHA256529d24e7ccee54830a632f917e098eb8c7cf544667c3fbc26d1a6888c110da55
SHA5120c6a3725771f4fe5d242a99e1d325309ba9885357e84a9c95326569ffe7c3b57a8b8503ea8c9766b38f564b9a10724724b73bdffdced4cea063569d69f7298c4
-
Filesize
1KB
MD5729677802b5094663b96490e37f4df64
SHA178778cc9f4ca3f07a7534d3eab05368c291f4c48
SHA2565f0d32292015591d37a546aeed9502085f52ccd50b2152494cc784f80480d531
SHA51251f1c846f705bd91a11754efeea75f9ff0543a97b7f43e403bf27de4eec22ea7cad15fdece94bb1d70b59350ca014e91b30d00880f33f412f1e7f17ad8842448
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
584KB
MD529c1d5b330b802efa1a8357373bc97fe
SHA190797aaa2c56fc2a667c74475996ea1841bc368f
SHA256048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f
SHA51266f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
676KB