Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-11-2024 16:54
General
-
Target
6b21ae416bf419e549f6abcfb92a86c66282a97644a6c5a6bf5f7caabba771b1.dll
-
Size
676KB
-
MD5
22ed96db2681802352afcea9e3809193
-
SHA1
2490ef64a6c9f8ca4d799a715f1dd677366dc6b7
-
SHA256
6b21ae416bf419e549f6abcfb92a86c66282a97644a6c5a6bf5f7caabba771b1
-
SHA512
5c1a7c0d48feacf2e28dd6094518ec0d1b1602fae4f42539291cf325e1b604b08f112234e6e63867e739d963a37dbae4823ac6f6985cc3f76485534f158d7cdb
-
SSDEEP
6144:w34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:wIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6b21ae416bf419e549f6abcfb92a86c66282a97644a6c5a6bf5f7caabba771b1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\y8K44JirY\unregmp2.exeC:\Users\Admin\AppData\Local\y8K44JirY\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fveprompt.exeC:\Windows\system32\fveprompt.exe1⤵
-
C:\Users\Admin\AppData\Local\470v\fveprompt.exeC:\Users\Admin\AppData\Local\470v\fveprompt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msconfig.exeC:\Windows\system32\msconfig.exe1⤵
-
C:\Users\Admin\AppData\Local\2GIX\msconfig.exeC:\Users\Admin\AppData\Local\2GIX\msconfig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD57355fa116592067ac116b797ffbee8a6
SHA149146d210a55bbb01b5b481c3b9836c6d87a751c
SHA256cc5a9b97c77c49809340bec71db4d85ffe9ff0f4c0737e997cf8779b39de30c6
SHA5124543a9d3dec1fee9cf590d72639413a1babb51832e04138531ad4758e63ce9c285d4d73d84b385d9a48bb13f1c8f5650bf8febc626d2aa82dfc873a0379618f4
-
Filesize
680KB
MD534cee7c031e33bdae058959e811cae66
SHA1e6ff83732be800b275062cae499577cfffde662b
SHA2561640ef03409c4c4ca930751e6454892dac8cd205386532aee1f10b587143f092
SHA512e6eac6432868fca3155236cdf7423c181edc7ac69dce4b1abcbed80e9c1f1ae84d29bf0e738d0bf7cf3b1b0f1b58adae435fa275f577e77f559719c989ec9334
-
Filesize
680KB
MD5305dd30b9282d9ffe5d4499754abd1ef
SHA1b698f3d4fe7e8a117ae2c44febb2d539b0827a06
SHA256e90af4f9e46f982465a4eb4ad8930ae6a12d547ca75fa59c0338551bc4daf0ad
SHA512ce3b5125e874f4f05fb29e5e78a29215ccc052b2ab899c9d2970ce8ca828521b854bfe490dfdc680502e5eb797d4e9b683e87ab105a1df091b1fee8499090181
-
Filesize
988B
MD53c1c451861eaefa3d25c8ca7aefc07f3
SHA1b59a8850b656b4543c4201d4f912bd31bc67b706
SHA256ccfb4efd46f79e16a055085efd907a416feeaac418cde913afad93b743d909a2
SHA5123352fd3a8cbcb9e77091de321cd6db1f8ceabfeb13176fcd008af0635a2263b4bc83bd2ee855447616d1c8d883218ea11f9d83ebd2be349ad6a28c12e5f5e161
-
Filesize
293KB
MD5e19d102baf266f34592f7c742fbfa886
SHA1c9c9c45b7e97bb7a180064d0a1962429f015686d
SHA256f3c8bb430f9c33e6caf06aaebde17b7fddcc55e8bb36cec2b9379038f1fca0b1
SHA5121b9f1880dd3c26ae790b8eead641e73264f90dc7aa2645acc530aad20ad9d247db613e1725282c85bca98c4428ac255752a4f5c9b2a97f90908b7fe4167bb283
-
Filesize
104KB
MD5dc2c44a23b2cd52bd53accf389ae14b2
SHA1e36c7b6f328aa2ab2f52478169c52c1916f04b5f
SHA2567f5b19f2c6a94833196ee1929d48094889b33b504d73d3af88dd857ceaf67921
SHA512ff083f74777a9cfc940d4e0cb55886397e27c85f867de9a5dd9ea2c2751d2a77bf75fe0734e424d9678c83e927788d07d0b3072024f7e5a9848c7ff1aa4090dc
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
328KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB