Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:07
General
-
Target
164ec74b8cd92223749f1f843b8518c3e337360376a5edcda388525029bb3117.dll
-
Size
676KB
-
MD5
1bf1ac0d053766f0b3f1463c6896953c
-
SHA1
73aafbff8a7ea3dabe84d5047add7442e52d43b0
-
SHA256
164ec74b8cd92223749f1f843b8518c3e337360376a5edcda388525029bb3117
-
SHA512
d292fd9143a267c4dbde98fe9f014cee96686579d8fb8ff692b7dfa420cac3085dd361fb06f81476cfb72ff72a5e53e9f15195dc4ceeeff57e9188b1ac5343d4
-
SSDEEP
6144:u34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:uIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 4 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\164ec74b8cd92223749f1f843b8518c3e337360376a5edcda388525029bb3117.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\xnJ3E\wermgr.exeC:\Users\Admin\AppData\Local\xnJ3E\wermgr.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\4N6lgGMih\dccw.exeC:\Users\Admin\AppData\Local\4N6lgGMih\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\BhQ\cmstp.exeC:\Users\Admin\AppData\Local\BhQ\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WFS.exeC:\Windows\system32\WFS.exe1⤵
-
C:\Users\Admin\AppData\Local\V0LahMy7\WFS.exeC:\Users\Admin\AppData\Local\V0LahMy7\WFS.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
680KB
MD53bea5bb501c6be8489c2d16778dbcd14
SHA1a237f8daeb882573cfee62f6670e625d76afa4ad
SHA256a6af4bf2eeabef414382c82e8657b9fc32bd01d6aa696f5e34015cd229892cc6
SHA512e2c653e13f79106a6cb8f782e10bbd8d7c51911a2762f4ac0d26ea40d64f0ba4affbe77ce691f24e1fa4e35b8435b9ef1682f8b9e9134808a16001d78cec58cb
-
Filesize
680KB
MD5fa8d8a1efb0b152896fa09901484472c
SHA1c3fff50bf7eb17e19cfe3054a03ab4556077d3fd
SHA2563ab1a4bdb459a887c5a7a5cc53396ce106e50607f0d24ab65dd11bcff44517cc
SHA512465c1f6bd8762de4a3fd83c3e7fe9b6d5178fb710eacbc1a448951a7c638b8380354e7be38eae91bb0896a306ad1db449a6ecc7c26cd286b034529c1b6f8b60e
-
Filesize
96KB
MD54cc43fe4d397ff79fa69f397e016df52
SHA18fd6cf81ad40c9b123cd75611860a8b95c72869c
SHA256f2d3905ee38b2b5c0b724d582f14eb1db7621ffb8f3826df686a20784341614c
SHA512851ef9fa5a03ec8b9fea0094c6e4bfa0b9e71cee3412ee86b2dfc34682aa5fb6455fefe7fc0092b711956d7c880cf8a5761b63ee990aa8e72f3473086ac0f157
-
Filesize
944KB
MD53cbc8d0f65e3db6c76c119ed7c2ffd85
SHA1e74f794d86196e3bbb852522479946cceeed7e01
SHA256e23e4182efe7ed61aaf369696e1ce304c3818df33d1663872b6d3c75499d81f4
SHA51226ae5845a804b9eb752078f1ffa80a476648a8a9508b4f7ba56c94acd4198f3ba59c77add4feb7e0420070222af56521ca5f6334f466d5db272c816930513f0a
-
Filesize
684KB
MD5def39abf9abe9c52140165216643689b
SHA15594c0e04a5627cbaf01db489c0914a85a9258d6
SHA2563c31a344f439683db3786d87faf83346f5fb47368647a8f6f1ea503111abd032
SHA512ccb154368db829ac223996d5b50dad4d1940d94878d39839650c88e1564b9a4a78834c3b97038b7582f2b3b004821c9dd85da61a2e53565c1f3158c5cc74b2a2
-
Filesize
223KB
MD5f7991343cf02ed92cb59f394e8b89f1f
SHA1573ad9af63a6a0ab9b209ece518fd582b54cfef5
SHA2561c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc
SHA512fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d
-
Filesize
1KB
MD56a88f3f6c564b48c0bccd80931eaf20c
SHA150e2d1a478c558955112ff46606f5d16df0cb1b2
SHA2566b7367fa5765960d930c98a88c9046eb27627ff1abf5dee90653005d6d2dbc35
SHA51200d8759083a68632fa4577b72d54b092e626fd281db7fd9ea69222d1c1d8f2456eafc3cc27bbd28aec00ae624ca07ba5ebb0e268d759dd5e0686ae9b3c71c715
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
4KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
684KB
-
Filesize
684KB