Analysis
-
max time kernel
150s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
14-11-2024 16:57
General
-
Target
26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a.dll
-
Size
672KB
-
MD5
e4b4e6107ac85d6d9981acf940fe05ef
-
SHA1
c049818fd585fe51844578411859c17c463b9bbc
-
SHA256
26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a
-
SHA512
09e324a23666faacf1817e4c4b148944789756bab8521d5d1182a007b0b680382769b09c6b376b1a07ce154a80aa1243271ca4d64b75abf73b7238bce72fd960
-
SSDEEP
6144:U34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:UIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\TLvDI\mspaint.exeC:\Users\Admin\AppData\Local\TLvDI\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\UIl\sethc.exeC:\Users\Admin\AppData\Local\UIl\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\zOr3JZp\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\zOr3JZp\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5ab3e8b1c4d75d410cc995b30b0dc61ac
SHA159975c08a75e5d1d7047c95858a288b3c955a9d7
SHA2569e766dc1fe90f19d3059c84fa0103e6ff2665a6a69123c179ba50c02590462a7
SHA512e0d03f8ac56916f6bac31ad802ff0c95dab027df38ab974d2ba10e6cbe8a3703893437670cc5d72ea39067f11b139f4b452e3364b887429a989e07cf2c7b3637
-
Filesize
676KB
MD5f2032529f345e34c339595feba780f0b
SHA108b88922df7f7d4399cf7b78440884e67b440ad6
SHA2565d500d192cf947773f70237de61d4cbd4c2d41571da4afb91ef561d38e8e472e
SHA51248217786e040ddad727a6c12bc760669a0e989fa21622e2cdf567db6bf694a6bdbe0d857faef183cc0882a49d003dbbbd16723c4fc39974279d98d71bfd6c444
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
676KB
MD5e1ff9e0aa97b7902ab139542fd5b36c9
SHA1903c2a0b1f43b7439d0e00349912c5b51fd2697c
SHA25623ba65760ceb365494f2447eedaf02480efeec74a370872e4fb7dc613831c60c
SHA512fb00aadc05c98d8f5e090402ad4b076f25a4927c1e31e9d78fe58b0ea47403881cf79f6e395731590a6700807533f5dc20e361823da320422190ad366ff9c2e7
-
Filesize
1KB
MD526e90f480bc0cecc05abd6687faed3cc
SHA1d113bb1c6b078653f2a79321a9da4529bbb5c22b
SHA2561a8372dfe3e1da4a8fdd1b639e06f677ad0b84df0611070743dc6f55c396fc07
SHA512777f0a8263ce3d809149308daaf2d185a5915362a7b83b673c9186cb6a3d63803ed000afe6ed377432ca0d8a9e38e80dceb57d34a47a21490641f47b8fa2f9d7
-
Filesize
6.4MB
MD5458f4590f80563eb2a0a72709bfc2bd9
SHA13f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6
SHA256ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f
SHA512e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB