Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-11-2024 02:59
General
-
Target
f92f9aac70cf3963e5f5366bf7671931ab030702f727c9b8e5434a458d1bfef6.dll
-
Size
696KB
-
MD5
79019653d1f2925d3a9df737ee411e1f
-
SHA1
029424f436526798306f7fe7c45000addcac07b1
-
SHA256
f92f9aac70cf3963e5f5366bf7671931ab030702f727c9b8e5434a458d1bfef6
-
SHA512
352ace41da765e9ac595d97bf0484d084f68df3ff5a858a888561837db8d083dcef0460ad962395e1086e2682300f3afdfed2c32d2c81b60679ea87890b84b1d
-
SSDEEP
6144:p34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTv:pIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\f92f9aac70cf3963e5f5366bf7671931ab030702f727c9b8e5434a458d1bfef6.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\lNfzu3\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\lNfzu3\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\QYNlrWBMz\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\QYNlrWBMz\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\JRR5lgLS\MusNotificationUx.exeC:\Users\Admin\AppData\Local\JRR5lgLS\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
700KB
MD5bacfb2e44949f745bac5ca234131424f
SHA1b81a77f0fde352340a85dc51dfe68f3cd854f5d6
SHA2560beb8dec66a40ddce2f25e1a9cd76411af3f0ce3092d760e5cc4b412567ddb0d
SHA5125c04032d61973916158f80056457d9fe65a81496994499623a15c84d9b330d359d52afb98e6d2c1528a2eff4b03dedb3d338b9494cae44f73026c5a6e9621082
-
Filesize
976KB
MD53b7ffc0e635bff0150b3b399c6782ef6
SHA1b8e80da7be2acabbeeaf50c8c0b4d84d761d0783
SHA256c6ea9f0237cc227f0da4c7e6760bcc0c18ddcfbb8ae96cc55bfae7d26a671258
SHA512fefb1a9a19df432008eb341950e2a0e72f6c0ffa86b57931064f80cbbfb8dc4e21a89618d063a9bb6e4303da2525ab9afd3daf8d1bd9ca4061de84238a4dc2ee
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
700KB
MD5770582c0489b432a9c6c06ed82181487
SHA16f5962a6472d38dea6b3c6da34c3ef66b18ab805
SHA256f27b09cbd5cde6d66e51a37eb9a551449e2f0c4cd53737ef43fcb0f9c1cb8ec1
SHA512cb0f7295c4af949ff620d07978c08f9ef7845acb2366da9963d02da0d246332c59ea2df28348bc7ad73d6ee315a90ea2bd66b69f587536e6d2a3a7f9d7e14ff3
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
1KB
MD5b636adda177ea89e5f7fc2a51a8799dc
SHA190068176f763c4b88d8f5a64a0934b7e74a5990b
SHA256738cec1dd7a086dc0e2928099554216e6c755965cc6398197d916dc36a09613c
SHA5121bdded5750ac47493bf092e9ae5b135a80cf0b2a3a9d79eb9022a40322b2156638de0e5f5a4c09a5d752704a5354fb232a8b1f1ce16c67ef6ad187c1d9c00f82
-
Filesize
28KB
-
Filesize
700KB
-
Filesize
700KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
976KB
-
Filesize
976KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
28KB
-
Filesize
696KB
-
Filesize
696KB
-
Filesize
700KB