Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-11-2024 17:07
General
-
Target
53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59.dll
-
Size
676KB
-
MD5
f598e27e26544b77e5fed315786c5ee6
-
SHA1
f501b7faadb0716c1c28206d5c1f285a0d22b2bf
-
SHA256
53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59
-
SHA512
81d118bde5aede49c71e8e55945e62794d7387b987633ce556129316c2df0feada5101b8611326e1f6827637eafb57d1a324a623c61a13a9ac53077f57687492
-
SSDEEP
6144:W34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:WIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\fvenotify.exeC:\Windows\system32\fvenotify.exe1⤵
-
C:\Users\Admin\AppData\Local\QFnx6xfSn\fvenotify.exeC:\Users\Admin\AppData\Local\QFnx6xfSn\fvenotify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Users\Admin\AppData\Local\gWIKlTt\psr.exeC:\Users\Admin\AppData\Local\gWIKlTt\psr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\iGAN5\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\iGAN5\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
117KB
MD5e61d644998e07c02f0999388808ac109
SHA1183130ad81ff4c7997582a484e759bf7769592d6
SHA25615a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa
SHA512310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272
-
Filesize
680KB
MD5a72238760e18d73dbda150788dc45597
SHA121da6d1545e9bb7d1c6d94ea0f5e4f3a6a255935
SHA256d768c1e7efff860477b12fd67bedc9435a2a44f041321b0c7fda947e849beea6
SHA5120c767bc34412c85089d71069264d4fd4571eae95f07e7cf27b9b13256d57b309c51c86ad49426f050a1eef63fddb062dcc071911fd837f5c8488d39dd1bee7e9
-
Filesize
1KB
MD5c022a38ca2f2d1df85342fa70f92dd34
SHA1bc54deb3a955dfe90a87d1e4c8970996a91feab0
SHA256d27f0efb674e9f4ebe821ba0c3dbf8ab412e7b91068551a247e5046925feb2f5
SHA51216e687dbd39552da0b7220d4759d53c51f66618246246ff39bf80179b5ec3ac7c21de4c8ae9bb72221fa0b86e395f066f9a0efee9c20441f3859a7ef4662c89e
-
Filesize
680KB
MD55b152fe331c5a855f6619dea2885417c
SHA1f58a9406290f157b9d0911b97a3f9bb4d73646c8
SHA256ab519586a526dd0ceabe4df4888acec3bf7aef4fc73dd4890f8d29d0c1edb85e
SHA5121686a09f8f09fbdb8c4eb4a55c7cfc2bb3e04c4cb662c689f7421d6e9b9608b65350ee8b4e1444648451f93f8132986639c39202c7ad4b56a312712d7c8ea7c8
-
Filesize
715KB
MD5a80527109d75cba125d940b007eea151
SHA1facf32a9ede6abfaa09368bfdfcfec8554107272
SHA25668910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495
SHA51277b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774
-
Filesize
884KB
MD5fc08ada48515cf857114041e53f0e71d
SHA140a5b2af6fe1c8a44f402174f565a57969b38d1b
SHA256d071fda053d66484899246df29a1ac0c07abfe8df1a308f9b7a18cb615a92c71
SHA512e4440675e94cb1bb83715b90fd31d5d7b8e8a79bd07f24e73e390870c2f45a2dee5a4b42f7551fdca766edb402e1db13d905ac495aaaacd540a5cc2db7641d3d
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
884KB
-
Filesize
884KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB