Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:01
General
-
Target
8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4.dll
-
Size
672KB
-
MD5
9b61cec907b4a11cfcbcfb77ddbc0061
-
SHA1
07065621f6777a6bcebf18a4df586d27fc97eef5
-
SHA256
8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4
-
SHA512
ffaa9b194a8634aaef20d215a4f805499cbc675335988f81e31dbb3aba2157b3760a7240a80703ea036ba54b0e5aca17d4ef6582a9645b30b6774f874772fc7a
-
SSDEEP
6144:s34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:sIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8909d1a1de17240d899afa4c15648c5bf0e154309522dc76c90e1a81ce6650e4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\a78\tcmsetup.exeC:\Users\Admin\AppData\Local\a78\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\fINFtJ\usocoreworker.exeC:\Users\Admin\AppData\Local\fINFtJ\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\RacA5psP\CloudNotifications.exeC:\Users\Admin\AppData\Local\RacA5psP\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
676KB
MD59b30c85610463b021ee6e8c514dae858
SHA11be6c99085c041fef6f4b6f72e124f96a09ea5f8
SHA2562272ede099a1efaa00f40010ac22e1ae16f26d299488f95b17c7990c727d6488
SHA5126e018a0ee80a41acaf730e36441772f3aae4ef1e7107de50da5539d700b5b5b2df39eaae5362f3914b94bc5c6afc314a4e4d55b1a2b81341b743108d2cf25b52
-
Filesize
680KB
MD5d2747087e617cf1d0a7ec4847c6fa842
SHA15acf25d41deb48c36ef5ff4e706a752f700a6465
SHA25646989fa94bcfca4ef14ef2033510ccf90b64c74471ba882bc104386379ff68eb
SHA51226bfcc9ae84249be2816e2b36f89fe52819fc215067fee19af31f67fea7b85d6bd4fd00a7be374ec6fd3a13bcd48390052d4825289f6202390ab384386108bf2
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
676KB
MD55f4e038b412a3e5f0465e8fc66ce0c09
SHA14c8c115e5cd50fa54e99dcbe4acc3c30625761ff
SHA2568236880d4e81f348c51cc62d8a246d99945d95d0064debecf060fdb89e3de8a8
SHA51263f98a012fb88d182179493700dc4b5e83039efd5ac19be06d30b046e2af0a04c0118cad2c6248237e54b77f221b3c8bb1335fa3130a3e28ae8432465dedae2c
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
1KB
MD55672974294e5e4714305fddd22287111
SHA1e37a6ad47bb0f5ebd7445b48a9f0a9e34df6020d
SHA2561cde5cab513b7c0a23b5baf1ec18059a9f9378a74b76d503ff53419020d49713
SHA512def2449830a0d90617ed96289d9c3fc79d68eec0c186490eead8a2acba1564de4ee27dc79b4f0b9651524c64299d5265da1e73ae2ba2da62c10830083dce901f
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB