Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:07
General
-
Target
53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59.dll
-
Size
676KB
-
MD5
f598e27e26544b77e5fed315786c5ee6
-
SHA1
f501b7faadb0716c1c28206d5c1f285a0d22b2bf
-
SHA256
53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59
-
SHA512
81d118bde5aede49c71e8e55945e62794d7387b987633ce556129316c2df0feada5101b8611326e1f6827637eafb57d1a324a623c61a13a9ac53077f57687492
-
SSDEEP
6144:W34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:WIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\53fb034c28cb389cc821736d248159eabf75b962d67c0a04fb05925cfeceac59.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\gIVjT\dccw.exeC:\Users\Admin\AppData\Local\gIVjT\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\tAbyt\AtBroker.exeC:\Users\Admin\AppData\Local\tAbyt\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\jKe\Utilman.exeC:\Users\Admin\AppData\Local\jKe\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
680KB
MD560e526249b5341cad0820c20877d5eda
SHA18ea766e1dd11b0e1e9e5384ba47f73bd8fd09971
SHA256cd94b9d5d37e405ed1a75fdf82580efcd736ed36c804d3bedfdbb68fca3970ea
SHA512762b3087c019dd708622e40ffc11c32c3d76a62290369850e1d14b15629cd6b680fcc9db4b08be30d78fb16718157d6aa7367aee00c60e64460c087d32f89ea0
-
Filesize
956KB
MD58e33a5c6df2c0a02dc95256b12d7b1d2
SHA1e5e5a32e15402060b2e12b1633736a3809faf16e
SHA25621d47f7fe042d20448f2d72e7c60fc3a0bc9731a81e2c3a885294824fd45d06e
SHA5120aac9649e620b11297b4080eefe46c9a87ae2f24704467d21b275ad1a34b877e817392cc884f265ef66c9ebe6f7922b3b3fda0830aa9641d780656235a533bb0
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
680KB
MD579f5fa00bbaac7824dbb5156637a01b8
SHA194fd4a60ee6bf11ded59595d4d6da534edae1a37
SHA256e6432b489d73dd1f162971328c331daeb75562368cc6d3d1d132b89af8084d82
SHA5123182e2ee1e54f5d0b34e231233139c7a8c638dc7b4b08915a5f1fc1fe89eba3f1335c890795ef87df3b9381e89e5284c5821af8845adb8fc6678c297687cd088
-
Filesize
1KB
MD5545cf6aa19fafb2d6e549177787a1dae
SHA14e1dec65660f222f30f109225777fcd6c58cc300
SHA256d3e254a831f8f22bca8773bbe0a4c0e9dbee864081d32d095a0977bbea699a3a
SHA512a81f3eed28d86a771ac34d6a5aa9398b889bcc2040a2f0de9ccae1d7b99781a63031569139d2bd02ec64ff69f0846e6bfd78ab77907d17bdde42ff2a68296db9
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
956KB
-
Filesize
956KB
-
Filesize
28KB
-
Filesize
680KB