Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:04
General
-
Target
9c8c8ac4777f6e405e3c0d2bb0e1bed5d1b2f76d20e1ade9e7c67b9e09df97f3.dll
-
Size
676KB
-
MD5
354125f74bf6ead1524646a2a042e721
-
SHA1
52f947c20843fa442f94cdcb49650369d27a96de
-
SHA256
9c8c8ac4777f6e405e3c0d2bb0e1bed5d1b2f76d20e1ade9e7c67b9e09df97f3
-
SHA512
36590d7ad1b0b747c644383879ce43c795b4a432b0ae9ea65c0fc045c06af802f0f71c2fc631e1a4519251135488e0c05fa21a289d26724528147b7ff7792af9
-
SSDEEP
6144:t34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:tIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\9c8c8ac4777f6e405e3c0d2bb0e1bed5d1b2f76d20e1ade9e7c67b9e09df97f3.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\nw4\omadmclient.exeC:\Users\Admin\AppData\Local\nw4\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\H4NVUKU\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\H4NVUKU\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotifyIcon.exeC:\Windows\system32\MusNotifyIcon.exe1⤵
-
C:\Users\Admin\AppData\Local\U9XDk5p\MusNotifyIcon.exeC:\Users\Admin\AppData\Local\U9XDk5p\MusNotifyIcon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
956KB
MD5908b39c1891af47f33bc18ed2cbe9f25
SHA1796b67629b5c274085cb88315606a35c3a54ca04
SHA25636fa5869dcee9c4acef895d626900e13c761790c546b7816e81e7416d23a0317
SHA5129930ba7520d4d2a21040708b65eb0e33111df5df7d4056571a16a8450ce105f03a825005dfd0b0beb8efafd2e247fe2fc65382b2aa3409d9a11ee5dedc8c39a5
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
629KB
MD5c54b1a69a21e03b83ebb0aeb3758b6f7
SHA1b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c
SHA256ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf
SHA5122680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19
-
Filesize
680KB
MD5482159ec597e9be2beddc5bc97497f81
SHA16d78a33890d58d86d0b759a0ccb054a543de3673
SHA256d13fa27cdb5c6b9884b71a3a083e7a6d27b28eb3f183c126947f6777d1c221d4
SHA5125a22511f8f9a2b3b8436c2f66690cdc93221bea4ed9f5416caaaaeb56e7ef8d57dae9b1ae56bc38b63b46d875432e3ec93590e3977d77fc2bda2e3966d30dabb
-
Filesize
680KB
MD51cd3aa345fa3fef64746b4d59adc36b3
SHA1c917328564f1e024bf34f21a6bcd6c68790f0449
SHA2565a84d1c85872d23dd6ed12649c12daa10da844d783ba009faa868dbc59705286
SHA5126059f152e4c4c9bb470e9d12fe6381c03e71a3a22f20c8bc0ee121ced481e96b393aa04d5a116dda4c0610905779f5a2fb00b9bcada37dcef1f423a1be430d30
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1KB
MD52d44d0457a27b6c5d6a9e01d3b5d28e8
SHA1070ea1fd1fec9bd27bcea62577f8053ac889c081
SHA25655c25aaa250ecd6ceb7a3d7c75c44167672c90c7094761e3d338070c8a03aed8
SHA51266c9eefb281d8c239b27e2d9a77aa156c30ae3e593d36867e5ea6ea6a0af46d25acd4f4d8e9d9f44f1899067dd5bb5a46c103d0e4bd5461067583e64ade1c4dd
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB