Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:04
General
-
Target
db76e9aef5769f4d7d4ca37b2f0160a8729aacc8fafae46190d58b99b32b1dff.dll
-
Size
676KB
-
MD5
9c45751dda6ab4ac264d1295ab158efa
-
SHA1
59b727fd59931da358622c7992fc4b9f9d20e295
-
SHA256
db76e9aef5769f4d7d4ca37b2f0160a8729aacc8fafae46190d58b99b32b1dff
-
SHA512
155f17dbb814e0cf27c87c3c059a9e5c70f17f3888c8bf70a9775655409a504db84a455f50fa2de52bbec5b962f2a2b9f2ada52012933a05380128d3c36e0652
-
SSDEEP
6144:q34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:qIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\db76e9aef5769f4d7d4ca37b2f0160a8729aacc8fafae46190d58b99b32b1dff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\77mSgT\psr.exeC:\Users\Admin\AppData\Local\77mSgT\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\x5eIUb\AgentService.exeC:\Users\Admin\AppData\Local\x5eIUb\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\a6hO7\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\a6hO7\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD5a2ca7f3012bc89e5340791d57234015b
SHA14d390205bf5fb991432f6c200c2a73876f24abda
SHA2569470be93f65bc664d785d4cf997df54d201923120b950cacaaefd66fd7b6f749
SHA512642260669ee4f4c997184047b77f101692a9ec24be7f95adf1d748981eeba6f631ae4212c06fe0b8f697dc69490d67884575b9edfa2a236c326bbca5cb0ae064
-
Filesize
232KB
MD5ad53ead5379985081b7c3f1f357e545a
SHA16f5aa32c1d15fbf073558fadafd046d97b60184e
SHA2564f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f
SHA512433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
680KB
MD5f84069fc4d4149ec40d7a695899d58ac
SHA166185b2c4804fee9a479630a79961e058fdae687
SHA25689afe061c3e6c3fa21e892ee51d4d99b153280ba5afe09fefe86a3525ba394e7
SHA5126b0e6c35b67894d96e48feb44b880051ec8c0c0ccc3b3bcb8a434f8971d8871f7454e6554819f1c281189d78119150ef8a859b2dcbab705a2727ed705280f95b
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
680KB
MD54ea392eb2b1a43122049f230a9ad702b
SHA19b12e1e7448244ea00f99f7fe3b43ac90ea2cf4b
SHA25650469e7c09a3669df9c897c1417fe7a3d112968b4b2e116595920c63110d41f4
SHA5128e48db1e800940ebb1a060fd89de0d6d22ac892439a6e6242a4411b329539982b2941ee655653fce4341ef83fdc3e26eb243289f50a552649de76d7bfbe0c61a
-
Filesize
1KB
MD541718ea8c27f67f08e545755bbba245c
SHA18ddf1b39cecc3103f3d884f8f5bde3b58fb1c898
SHA256ca8d5f9caab1c9e0c504cf8eb89f6a25947f8eeff7586a58fbdeb104e6a87a02
SHA51205df9c04b5bb8a1aee7cd909b10675fff4c9e364a66674f0ea04adc0b0ed88b3d661a1c664cc85578cf0e2473c64b734d9484e99f545e76dce5c0add325ff125
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB