Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
04-11-2024 16:18
General
-
Target
b6f78736575bea5b38983159e95a2f629265f4cd083f5773fc418b4c88ce0f41N.dll
-
Size
1.5MB
-
MD5
c026fef0b6c83c6a08c9087fc4fb41c0
-
SHA1
d029a15df448443c79f3880f07bad27cd0e514d7
-
SHA256
b6f78736575bea5b38983159e95a2f629265f4cd083f5773fc418b4c88ce0f41
-
SHA512
f5fb293ef024d11d6cae0142e199c134ce3ddd03bab007f41d07ca896ff7dd38cc86556174f1da5f6affeedd1e09d245680e294f7629c5b73fe9d9de7fa12a6d
-
SSDEEP
12288:SVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:PfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b6f78736575bea5b38983159e95a2f629265f4cd083f5773fc418b4c88ce0f41N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\W8nTkEt\xpsrchvw.exeC:\Users\Admin\AppData\Local\W8nTkEt\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\0odQ\WFS.exeC:\Users\Admin\AppData\Local\0odQ\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\zya\msdt.exeC:\Users\Admin\AppData\Local\zya\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
951KB
MD5a943d670747778c7597987a4b5b9a679
SHA1c48b760ff9762205386563b93e8884352645ef40
SHA2561a582ebe780abc1143baccaf4910714d3e9f4195edd86939499d03ed6e756610
SHA5123d926ddead8afcb32b52b3eb3c416d197c15e5fff6ba9fa03a31a07522bdb9088b32500fc8b98d82af657071571d09cd336a65cf45c485ebcc145dea70b3a934
-
Filesize
1.5MB
MD5d4f02919e6acc6de57f65e3f438d4b06
SHA172c3a126f6b411b00fba07d47245ce909a74b4f8
SHA2561d17d7e6662e83117133bec3f4037f474019f86de2c51b7696dcd63bd27a5b2b
SHA512f7932cf01564d9bbaeced30c0c0000e70add82bb40f93a0058518ca9c7b0c2206ac5f2c6fdc90d5f44bf82fe349096fc2c5d7681d8ad9888bb79288547f175a9
-
Filesize
1.5MB
MD5d91aa0f46f1b07d9ef3c63eb0b149fb0
SHA1208f210a2aaff5ea9094be08d5c6c03e2b860c22
SHA25683eda3bcdbdc48bed5ea40dcc10d9892dd8fef62d62b8e8a9c848264cd0ac7a2
SHA51232c88ffa777ba578e2e732c6478c54e3e2993ff305af5b22575b93ac00e374a7f09c0af9f30997336acd7a99432e0f8c765e8677413a4cffe4f384ec8ae270da
-
Filesize
1.7MB
MD566468614b01c05cf649c86c71f14f8b3
SHA1c874a50aac9578e8d54a65a86fbb2909e9a0b64a
SHA256f60ad2c8c5bda59a3a699400d7fa30fa0840cc5f9dcb97cc2b16f4bb12d0d837
SHA512394d8ff93300deefcc778889d07894266e1937b2dc2a4073587d26e8c3e19ed9b191b0310bffc0bf74165270fb3078ae112b51f0ee09f29aae473bef268e0968
-
Filesize
1KB
MD562ad1d009b0a07f59dbf8e3f7ad89747
SHA1f59b63b9e087bce59478702ce95f8d825b01f51f
SHA256809d2467ae7da8e4600aec332f9608627fa8f8ee715cd623483904e3d0cb0ec7
SHA5122308e614ce215363e199f30f065f3ba91ed07573c768231a4bffb6676122479cea8460e97f263bd1e38aaab71b30fee7cd708ea68838b7d97a5d90fa5badbce8
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.5MB
-
Filesize
1.5MB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB
-
Filesize
1.5MB
-
Filesize
28KB