Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14/11/2024, 16:57
General
-
Target
b5a92b20ca55f3df694fbdb63f6d5bd6d7ce96581d341d282223bd33bc0753dd.dll
-
Size
680KB
-
MD5
5b9fde8a7db8bc2c53fccd4187db1c8c
-
SHA1
fcac82c487ba59787aa3e3be98aedd6e2198fc1e
-
SHA256
b5a92b20ca55f3df694fbdb63f6d5bd6d7ce96581d341d282223bd33bc0753dd
-
SHA512
88ee1dc23bc6ab839334667e2f82ecfced7b5ac488c1e9f6109f6e1f0d5b245fdaaccbfabb5faa5b67ad91d8780f018daee28dad9ea389ab8defaed4d24f323b
-
SSDEEP
6144:z34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuT7:zIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b5a92b20ca55f3df694fbdb63f6d5bd6d7ce96581d341d282223bd33bc0753dd.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\LO89CG4ag\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\LO89CG4ag\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\aD1T\rdpclip.exeC:\Users\Admin\AppData\Local\aD1T\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\3KnfQAj\OptionalFeatures.exeC:\Users\Admin\AppData\Local\3KnfQAj\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
684KB
MD51ac9640875fe58a668d44a9eb5e5753a
SHA15fcfb496b11964bdb21d6b184a1f8c876dfeb46b
SHA2562272ee6cbabcd0fd4bf499e0039aeca4b7c5fd4b383bf7e4dfe31b69c383a3d9
SHA51268825e0d6ae19b4124260a50ae4ae66f9a5d452557313cf6425e5d47561c193d1e0b317194b345409989af0c5d502c6608fbc69e81274a522ef53d79fa47e602
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
684KB
MD5ad56cc31878df0ee101705991a2e68f2
SHA1058e602c7ee599229236236da0977f6414cd4ffb
SHA256bd7ca369fd8c4503a257a95569ee0cedfd5bd16cc194d1795b6043690b152b65
SHA512f5b56aca1b9ae5d9a9b451b6e0e4006023cdfe56673c6b92cb20ccc7a4fa3bc23fc64fca9e74b0c3f46eb5a4db5e38a44835c44d98b54c3e750c3e87666af77e
-
Filesize
684KB
MD5fc33f422d18b5cb071e1297c5378019c
SHA15bd2b3c1d1a431901281b350728c9485be097557
SHA256f21660a0349d3ab4adc16369dc6e1d3d043fd0c601e177af9931b24008574b03
SHA51216ccfef7070f9e5f6cd056093ca05a0223f7b9d96fc05749c65d67e3141b43567a4423be881bfddae9c899c736c60c0acc99c7d80a3089d1d7d43b9ece463256
-
Filesize
446KB
MD5a52402d6bd4e20a519a2eeec53332752
SHA1129f2b6409395ef877b9ca39dd819a2703946a73
SHA2569d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308
SHA512632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e
-
Filesize
1KB
MD548f149af37a8edf336ad93731a5aeaad
SHA1b241e11340d92a6931633c83d4e62c574b9f53ca
SHA2566c814b39cc427521e62620d8efa4062a6623dfa056c70b11c4117c1a49426c81
SHA512923cefd54d31b5c67bafe149e381a69c69d66ff4adef78622363aa615792f7722fd2ff6e1cbfe6bb650f1052aa3ec2ea2cc0561e4eac9bfb0872431fa1e46635
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
684KB