Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-11-2024 02:59
General
-
Target
fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58.dll
-
Size
672KB
-
MD5
089bbe4454e8a5806c2c27247bd47c3a
-
SHA1
837ada8cd4d906788c34507cc413a78389e91c02
-
SHA256
fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58
-
SHA512
a789910c2cd0698cd0f383ca4bfa2f54b8c11c640aa74d632ccaf9596c8353c319f0b05612b7b590fc860eaf131a7d783f1ed735f82975e7d77a3332154a937d
-
SSDEEP
6144:534xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:5IKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\fd7fddc39d5bc3bc942c4575c57bb305068eed4e8bbe1285733e23ec9b18fb58.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\qPHt3u\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\qPHt3u\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\1YAKxCYrS\osk.exeC:\Users\Admin\AppData\Local\1YAKxCYrS\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\GHLkgnHr9\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\GHLkgnHr9\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
952KB
MD5ac3e2c0fc1c3a425fdd996037b7f55a3
SHA1f66739c3046379d0d6c15bb937248af6abec0690
SHA256bc63b716b3d6a86a4386913e6b9277c4905d83c0dd6a8b26aa2519fcd40d347b
SHA51278accd34f33d686c02881388b40c490e33ce6dc00fae7f84175c1e409cc3909b1af2c42dfdb6142404c6536d63656e2551b8c9ce31942ee0b9d67cde2c87b0f9
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
676KB
MD516a1ded008f37380ecf69345a6b6a89e
SHA1278b94ed6fdfa1c73b1483dbae4e771b26b426e3
SHA2566bc87e0178eb0c39ac9917ec618145143646e50f1411f9369f2346f0c9a79328
SHA512fda97822bdca29bdfe617a8ea78ab528c7b4a987df59d9666f6e011cbd65cbf4880a29ddc8958d51ea9c8154006ec1fdb87035f59140b35ef1e37f8ede2e937f
-
Filesize
82KB
MD526640d2d4fa912fc9a354ef6cfe500ff
SHA1a343fd82659ce2d8de3beb587088867cf2ab8857
SHA256a8ddf1b17b0cbc96a7eaedb0003aa7b1631da09ebfe85b387f8f630222511b37
SHA51226162a3d9d4a8e3290dbcf6fe387b5c48ab1d9552aa02a38954649d877f408cb282e57580f81e15128e3a41da0eb58328d1d6253e1b57232f9a8cecdd99991dc
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
676KB
MD5bbda6cce76c008a1b282fda494c052fc
SHA11415056e0f6df2a2576b7fd7d6c342b478478a04
SHA256cfbd0fd5fa8d26e8d485417b6d8588141bfce5c2aed9e720ee5d771d68260aa0
SHA5129031b839913967a4d0e8dde79d5b45a3e039456dad81d260be8ce38a14dcf9dc98022e52ba76246a1645174f74a638ce431c112a88ac7c6ec6a439a2e9c835aa
-
Filesize
1KB
MD5c0325ef01d0e3fcbb1079509deccf1f1
SHA1a0a71d0a87139b9bc7ee28bc828d9ba0cc4f89a0
SHA256039574f1bd74dd965d7f63eeaeed09c7eba594245ac475aa3831dfd284cab124
SHA51268c8e3fd6f1a8fffe9f9aa2da5a457f10eecfdf2fe0246faad2981e7fcb49ac8dd1c33a71979624b83980e53f4ac560911d7345cfb4158c7c5684d3f0254d43c
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
952KB
-
Filesize
952KB
-
Filesize
28KB