Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 16:57
General
-
Target
26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a.dll
-
Size
672KB
-
MD5
e4b4e6107ac85d6d9981acf940fe05ef
-
SHA1
c049818fd585fe51844578411859c17c463b9bbc
-
SHA256
26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a
-
SHA512
09e324a23666faacf1817e4c4b148944789756bab8521d5d1182a007b0b680382769b09c6b376b1a07ce154a80aa1243271ca4d64b75abf73b7238bce72fd960
-
SSDEEP
6144:U34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:UIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 12 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\26fa4f3e2ff9d20e54a8ed92898d8d524f973424a6d7b6d62e489e3d5b9fa66a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\UGkNdUS\AgentService.exeC:\Users\Admin\AppData\Local\UGkNdUS\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\UuAvj\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\UuAvj\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\3ZG8d\unregmp2.exeC:\Users\Admin\AppData\Local\3ZG8d\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5ec8d9d7d2967312e27001dc8a8869b3d
SHA1d80cea08460066238ba433160f17b3c051f682c2
SHA2569974e9ef1dd7d7f515f81e2f9374445ef2c783d3d4fa6013f7ba5f7768ebda0d
SHA512a63a75d349e396ea4e9dd477a8314478cab1d87b48d024a897ff87be0dcbc82d743dd04f3bbe5484c0503093e551736c7397f4ed8dd6f7b53bb8be6350b8d90e
-
Filesize
259KB
MD5a6fc8ce566dec7c5873cb9d02d7b874e
SHA1a30040967f75df85a1e3927bdce159b102011a61
SHA25621f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d
SHA512f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
676KB
MD5f955a8c412fda2df9b08b993e39e2263
SHA15187a0413554e83b19c21255ecf21dcc72ff20db
SHA256b45602abcc0fb292248aa4ed0300b8bd3f43de884e1a56957c7003cdce8bc6c7
SHA512cab7ac42d9f7611b6592e0002f11a84522dc7300e5e5959fb4388293043650758a84a4ff89f615b8c25c277d7ad3b355dac116a2baf8684d0ab7aac8052aba67
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
676KB
MD5230207d38eace339aa9e7bf8a07759a6
SHA1e9cf2b6d12f82a7d0dc0135e34711f9fc48922ac
SHA25636dcc47d8b102efe390403667e0ec72f8396d27d47e7237a0b5dfca608bd861c
SHA51213fd19cbff73ca30777b890778a5260fdbd9e04ada79358a8f0fc86325a477927300d4b79af14454fcf07f3372d1320b6e966274ec196e5e6921d1cd19ea9c3f
-
Filesize
1KB
MD58921facb9516ea802fc1c646785bf1d5
SHA174c3f97ea2133d5a80491eede54d6ad6f4d14e9d
SHA256013f2aeca5bc298a3d6a87804a9474855dd862914da4297a6a20467cb060e1c8
SHA5126a60bf267f23de2f974fab9aaba7cc96b8c638d00bd147af3ff2a5d81d15ee11d2502beb8c4f2aaed85936c7cf874e5453b330e43e542d343bc791c564c1f1e4
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
672KB