Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:04
General
-
Target
a130c1024af7fcf7867614670b20c294d55f5b579a62b2dc630f5cf067863d24.dll
-
Size
680KB
-
MD5
f6fd2fc4f63d0ba67c61851cef213a49
-
SHA1
fe874064329ea907423131cf7a64d0f3b6461d2d
-
SHA256
a130c1024af7fcf7867614670b20c294d55f5b579a62b2dc630f5cf067863d24
-
SHA512
3e85f9fc2ea96bd35a36ffcdba6f7c54665666e6cb2eabdf6d5f2bc01dbc6e7b3c64f92e2e3ef626e5fac743527eebdb3698840bf6e0bafa3eeab04a922aa4b1
-
SSDEEP
6144:e34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:eIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a130c1024af7fcf7867614670b20c294d55f5b579a62b2dc630f5cf067863d24.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\iRoo\perfmon.exeC:\Users\Admin\AppData\Local\iRoo\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\gi6z3\mblctr.exeC:\Users\Admin\AppData\Local\gi6z3\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\okHnSz1f\Dxpserver.exeC:\Users\Admin\AppData\Local\okHnSz1f\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
684KB
MD5199c7df975c2b52ae14cbbd515c6ef47
SHA19f609ae162c6408cffe52012c97d6bfca5fbe436
SHA2568b2a80c17c1c0f91ba35bb3ec5d396060b11e9facb97c5caabf50ebf5df66ff1
SHA512e1fabf493e974aeeb944f9cf42a28e638fbb150b94a21206a5f2065e5ef0a221bba3d3eb665ef59d56e974e1a9f5c71e7555d15eeffd4fb9c77eb3956743c05f
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
684KB
MD526c79a34689829632d53270900e30485
SHA1226442cafd7ff967b01e907e1c9d2b05e5a05dfe
SHA25614ea1be5a566b35aee916299bac8282af4b311bca9655cf97d6bdf93e13b5986
SHA5127a635f35295b637a12f8690fb3220fb081262f70b5e529a48783c077716775309745b0bd2e6abc2efb9e727809dae21b351a0caa56f98f2c493f8ac7ba151638
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
684KB
MD514dddae0cec2f91f38be498b8b137595
SHA14b39c591f6e7d0a89b6842b4df4b06599a75df5d
SHA256c5ebd868ad93ea4110287618984a997e79861cb8b5f65d672789ea545de19307
SHA512353728a2d4160b631c04880a2fd83a667256b37c45f3b6b54f82cd4ae035e9808217eb88729024e9e079f8157fe1847fac8e3c339046d4f3d63f968eb4456f0f
-
Filesize
1KB
MD5d3ab1aa6b698161b55c795e1e730b243
SHA131856d3f26c6b346a73f97f2a2054127da10a36b
SHA256e99799e1ed470109837fa326d625b96e786d4f08d6894236d02facd15b31aacf
SHA512272e78d7dabe22418ba42c0e8415dd8f5689ed71ec8d1f09310d0c43d2fb1c659d6a7c320d3a8106452f43b96c73f77f50d61c0784dfff03bccd2549b70c762b
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
64KB
-
Filesize
680KB
-
Filesize
64KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
684KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB