Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:07
General
-
Target
534d2ed9bae64039fe0e0f0fa0b51caf808d603f70d0e34c54dbb9a018801739.dll
-
Size
676KB
-
MD5
fe55563a35f75a22d84ca5916747d82c
-
SHA1
39b3b39299ef909314d2edc5c8808b7d495c8b0e
-
SHA256
534d2ed9bae64039fe0e0f0fa0b51caf808d603f70d0e34c54dbb9a018801739
-
SHA512
5e74de0700fae017bbfa89b8636ba4c6c9b09e46660c56fc2502777aaea32ec98f405863bf5ec656b2282c14638864b8006853f5c711719f2d98dac6bb341ba1
-
SSDEEP
6144:I34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:IIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\534d2ed9bae64039fe0e0f0fa0b51caf808d603f70d0e34c54dbb9a018801739.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\vD83\AgentService.exeC:\Users\Admin\AppData\Local\vD83\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\usocoreworker.exeC:\Windows\system32\usocoreworker.exe1⤵
-
C:\Users\Admin\AppData\Local\68t2dF\usocoreworker.exeC:\Users\Admin\AppData\Local\68t2dF\usocoreworker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\Rw4TaVB\WFS.exeC:\Users\Admin\AppData\Local\Rw4TaVB\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD535052858279423ecf89a11e52197dfdd
SHA11207e5af800d5843b9c6d3388217067b3ae8e8f5
SHA2568639e8c7ed2d8ab79a9b1afc83420cba15f9ea769baf540078b9e78047320022
SHA512932dcd196eccbc7f6b37369640dca10a7285c0a372a6a7e217ac78affecd38d962b5ed1479ada3c4d1e88a5eccd9d9ef1a6bbdbc5bfaaf33729f43dec1d9d5d3
-
Filesize
1.3MB
MD52c5efb321aa64af37dedc6383ce3198e
SHA1a06d7020dd43a57047a62bfb443091cd9de946ba
SHA2560fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e
SHA5125448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed
-
Filesize
680KB
MD5aa683b92fcba485f658933d9263535ff
SHA1bd2aaee42c9c4879cbf5a801ebc634274d4abd05
SHA256a4c6c6092f060c77a1135980bc1b1d987d2c74e241bbae8c733f76e09796774d
SHA5120b2b11ce355bdaec90325d7499be1b9bd090f6cf6a1c95bd9980dc20216b9ea0ac8d92c361a4c7cfcef1587946f3b23299769ac2e503c127a30ad9806f38199a
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
680KB
MD5662fc90fedfe762aaea948196dd7ef97
SHA1a6355e2093cc395ba2fbb3df16bce2db094a8227
SHA256b9331c10f0a4128c7d5f3de217f3ba7208e2b380e0adc2169d8db2380be6af49
SHA5126cd4e201b66316a270d8af8ace883af4269a26f8ee272735376aebe2cbc526b839f16fc4875aae5d56f75f7b4bb7a827f45d67222d6a3f68517171db2f102968
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
1KB
MD528bb330420e1cf84bf48ce47dddeb856
SHA14ce5b102ec1498fb38f9e1eaf6dc72e09fbf7fdc
SHA25691b5812664025b0ce0fd434738630d686e91e89baf4e3abb0c6ee5e566409b98
SHA51276f9c41da4daa0c8cced123b195a650f11980a13a31149bb7293279bb3c1ac957e70b3dda9e4bc54f6bc25b53b1ebced81a43aff2275a50b4ddb14f76dc9786a
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB