Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 16:57
General
-
Target
c749a6d6524352a22d0f2233ce60383865b387a689d3630e2f574249dda35a5d.dll
-
Size
676KB
-
MD5
c28e410fb7df7dca23a4c47feace68e7
-
SHA1
98cce2e4073e23dbdb4af2535566b5cc8e889158
-
SHA256
c749a6d6524352a22d0f2233ce60383865b387a689d3630e2f574249dda35a5d
-
SHA512
0c73a663199187ef8a587c62ec5082ad843cefb9160cdb2ab4dd5bbeba0e0ee951da8cc5897b903510fc2efde3fd9743a03e5580c9b6a5efab76e8b60c455eae
-
SSDEEP
6144:z34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:zIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 4 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\c749a6d6524352a22d0f2233ce60383865b387a689d3630e2f574249dda35a5d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\3aL7\mmc.exeC:\Users\Admin\AppData\Local\3aL7\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\w5h\cmstp.exeC:\Users\Admin\AppData\Local\w5h\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\5WLW\wlrmdr.exeC:\Users\Admin\AppData\Local\5WLW\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD508c108a34e172126da33f533b906aeb4
SHA1e4c4a1a2fd9d052d1a3ce647b499ec0ac765522c
SHA2563dd057fd7d393b71ac9644e491cc53761623a87c18c2e9973817f82c13bea8bc
SHA512a23329161868ec988dee51094a379d8961eb5c28e1bef0a8832079613c50d6ec56456ba5a39ce0ecf88628466255f22e0fc3d6abc80d304ac1d7f5d4cf78f006
-
Filesize
1.8MB
MD58c86b80518406f14a4952d67185032d6
SHA19269f1fbcf65fefbc88a2e239519c21efe0f6ba5
SHA256895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a
SHA5121bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099
-
Filesize
956KB
MD5d6ff11df1ff4395ebe9f0aaae319e387
SHA1632ca5502b9356caf01332b2e35c72ea825017e8
SHA2563e13d75d11452a98f4a2e135524b398de20ed1123c5180684dc69a814ac5e5e2
SHA512a3840681992a06e7d9e87a476657f0e68b5b91a12317022745e42c1add0568855c52c76d1fa1dfbae34b1e454ebaea7aa74080636e7ac97d6f0fd4d7d125bb0d
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
680KB
MD5a9066d4269f56d008f71aceb424ad531
SHA1a2c528d32b092ec646e376bcd242cb702d0a03b2
SHA2564b29983534ef9b9964ee1a515aaacb4ed0ce97840bf77af6cdabe0a0bbae2ff0
SHA512aee7a3154aff5203422fa4df6769f6684bea63bc7708d9ab2aed2b74b00c93bfdbc4467efe491477565108167edeed9424a036c4c8c41515b2b3b5adbcd88d2e
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
1KB
MD52e6284c9a7aabc7ef84690bcbc5ebc89
SHA1f9b5766ba2d5fefb3716db316ccbef6ac2cf433d
SHA256d05a0de3d9cb7451f9693a1970ad4ad40e24f81259fbafa50f70199f0953adc3
SHA51220010c51c05c41287751d75f9b1d6b093b37f65b8e64c48d7c095176cc2fae6b43b5eb7b19685f622740916fd8a852149b44d4121984d86db77715f204279abc
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
956KB
-
Filesize
956KB