Analysis
-
max time kernel
150s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
14-11-2024 17:01
General
-
Target
8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4.dll
-
Size
672KB
-
MD5
9b61cec907b4a11cfcbcfb77ddbc0061
-
SHA1
07065621f6777a6bcebf18a4df586d27fc97eef5
-
SHA256
8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4
-
SHA512
ffaa9b194a8634aaef20d215a4f805499cbc675335988f81e31dbb3aba2157b3760a7240a80703ea036ba54b0e5aca17d4ef6582a9645b30b6774f874772fc7a
-
SSDEEP
6144:s34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:sIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\TpzrapKZ4\tcmsetup.exeC:\Users\Admin\AppData\Local\TpzrapKZ4\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rstrui.exeC:\Windows\system32\rstrui.exe1⤵
-
C:\Users\Admin\AppData\Local\d12H7fKp\rstrui.exeC:\Users\Admin\AppData\Local\d12H7fKp\rstrui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Users\Admin\AppData\Local\K8g\wbengine.exeC:\Users\Admin\AppData\Local\K8g\wbengine.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
676KB
MD5df8289990590a1d13b2378c348659bbb
SHA18e8a7a7277da137570e49ca965c5fc5fa3ac5f8e
SHA25655912adeadd61d6e193ccd36b421722d38e238f2a8731f34fe042aaa3785c42f
SHA512f514257d17c9509298af5b38329a09fe3d172d9a8836d123ef9768f36b791f1da25fd7316cdd396eb059251e7a1670a6a34cc0d29f93f2eb280983014afc950c
-
Filesize
680KB
MD5d4d0bc4f8717305ae3758513fb4fc51f
SHA10d0bac2ceedbd3786bb4c2bdb9b6afe5ddd8bfb3
SHA256a179bcac4c8f05a54b71d6d441216a2adc8c100c68306ecb59438ddfdd0017f9
SHA5128563d32849e8ff31244d371aed8464fe6ccbcb3c3a0a46be4ba528f450bc2e61058ab6dec9a3e764ae50dba6ef12a6def47b096fe36a5692431a6fc00a567a6b
-
Filesize
676KB
MD560a8c451ade8d1c6f099b1969d4e57ec
SHA13a96e4c56d286c971ffa2f75e0708707d3c5395a
SHA256b604b3147a112617feefba08f235e68b754a6ad70a3b2e3de8d1188a7afb8278
SHA5122dd4421355a1a136dca8d02d7ad5d8a87e17f0cce1afc680e8ab7309507b11557f8087b696faea4e4c9d18e06a42a8df7423bbebbf2746f192b8e2ca5d19f1b9
-
Filesize
1KB
MD5f9da002a759c3f1ab46a0cc11683896f
SHA17ae8ced7065fa39adf8c4cb4692fb676014691a6
SHA2563f93b5457585c7035fb4739a99bfc57e9780bd5a71f963e4f5f198256ca55fb5
SHA5122b472b441403a59dbdf72d248a7005e80733168ad998993d9ccaaaf14534d1338ede1eae6220f45767033fa92e0baf1e6c939ba00f8f6c4ff357013bef7cc40d
-
Filesize
1.4MB
MD578f4e7f5c56cb9716238eb57da4b6a75
SHA198b0b9db6ec5961dbb274eff433a8bc21f7e557b
SHA25646a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af
SHA5121a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2
-
Filesize
15KB
MD50b08315da0da7f9f472fbab510bfe7b8
SHA133ba48fd980216becc532466a5ff8476bec0b31c
SHA256e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7
SHA512c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58
-
Filesize
290KB
MD53db5a1eace7f3049ecc49fa64461e254
SHA17dc64e4f75741b93804cbae365e10dc70592c6a9
SHA256ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49
SHA512ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB