Analysis
-
max time kernel
149s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:07
General
-
Target
51f1a8d4410d73d9176dcd9625d7522c719e816e43bffda25085e63161d789b0.dll
-
Size
672KB
-
MD5
583d65e532c265246326dd54fca82723
-
SHA1
459a26aa86533f45c0dc34201174d773d9c00e45
-
SHA256
51f1a8d4410d73d9176dcd9625d7522c719e816e43bffda25085e63161d789b0
-
SHA512
31b313d6bfbe3eff58ceace0a442c83ec4eeb183b2281a79bbe66527c171bc866adfb5f9c9f1b5ea8f54046278c30eaa9f215dfcf207e76ac6e63dd3555dd94b
-
SSDEEP
6144:R34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:RIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\51f1a8d4410d73d9176dcd9625d7522c719e816e43bffda25085e63161d789b0.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\nkv\EhStorAuthn.exeC:\Users\Admin\AppData\Local\nkv\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LockScreenContentServer.exeC:\Windows\system32\LockScreenContentServer.exe1⤵
-
C:\Users\Admin\AppData\Local\eP2\LockScreenContentServer.exeC:\Users\Admin\AppData\Local\eP2\LockScreenContentServer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\shrpubw.exeC:\Windows\system32\shrpubw.exe1⤵
-
C:\Users\Admin\AppData\Local\u61j\shrpubw.exeC:\Users\Admin\AppData\Local\u61j\shrpubw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD526689034dbe0e875776ccba7ca5a47fa
SHA10b57e65e168d79f79a3d242aa2518c1556148235
SHA256fd95f93346ce5a1f270dd6aae1a20ebb805847651a1589faff7b5d6b41f2552c
SHA5122b738b49bcaf413232c9f06995cf0002b73936df565131e60fe657cdb58189bab7f8aded97d1dc7831d121afa2b885ef5fbf50e7a24c13107b4bc5fb85eaf085
-
Filesize
47KB
MD5a0b7513c98cf46ca2cea3a567fec137c
SHA12307fc8e3fc620ea3c2fdc6248ad4658479ba995
SHA256cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6
SHA5123928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
676KB
MD5033fb72598b9152453c7bc518dda1c3c
SHA103bbeba204bc454df87d689d22a38560ba50bc49
SHA25687f402bc7cde42f52f43c819ea084af5e5173ce0a7fffea5a9d3b0d626c913ae
SHA5125260f0e3b0c6e711a2931f785808bb84ac1b9266c5ef0708c763a62fb52fa30dbc0615dc1846bc9d01a51fc2ebecd90a3bfd35246b4f485743c8ee7e50c732be
-
Filesize
676KB
MD52c3c9626d98ea70c517cba54dfb86316
SHA186b125d208f9787520e9e26c7c15f7c24ef86fa4
SHA256e9b1e54b60649871df5a8e30293c42f4cef91aea1852f0b8b08c6d00c49bbd01
SHA5128024f1152d459f082c7fc0e5310fd1ca1e203254cd9da53488b5d1009d16392ceb42c5dad561a384febf16f12803412bbcf2fb8750ea4c3c203e2721fd698ec0
-
Filesize
59KB
MD59910d5c62428ec5f92b04abf9428eec9
SHA105f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b
SHA2566b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e
SHA51201be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb
-
Filesize
1KB
MD5a57dffa3ce1acec871d53bb6ce0c5002
SHA10d5a578c65bd8dc2f88e61a083651f2f7588e6b3
SHA2565e773707f6e7de8eea6cf82cff1cbd0eb38ba8d056d6d0ab8eb42ee0fb6888c2
SHA512142d535204e6e1ea6147638a17ec3f880284f0c9566bf3476d36a1083cc7713996b697800c29675b529d4498427ef7c5632ce9f293f2a8e80e10809bd31de2e5
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
676KB