Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:08
General
-
Target
69c455745647cfb7a255bb03b8a4279b64be1e542bc8c540c180b2884b8d858a.dll
-
Size
672KB
-
MD5
9b616d2c751b6b29a1c2a529a49daba4
-
SHA1
46341d4ab5707193e9e53ffc140a42a61b6629a4
-
SHA256
69c455745647cfb7a255bb03b8a4279b64be1e542bc8c540c180b2884b8d858a
-
SHA512
ac1e27da3fc0d5541382425232677e832896c6d3b8fa089db4799bad3a0383a1eb1e737f9b1f34213d30bdd842e1ef335599d4ff07c2b40f8f490e035c858f05
-
SSDEEP
6144:I34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:IIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\69c455745647cfb7a255bb03b8a4279b64be1e542bc8c540c180b2884b8d858a.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\WKh\mstsc.exeC:\Users\Admin\AppData\Local\WKh\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\vmDG\mstsc.exeC:\Users\Admin\AppData\Local\vmDG\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\czXK\SndVol.exeC:\Users\Admin\AppData\Local\czXK\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD5d53480d18124e857bb5b62d871551ccb
SHA10f23433c213e904ed3cd5607479ae67cc4e4e762
SHA256b93b82b4443703f7bbb60c2ce9fd5ec80cfedd81bdf9b6ea4f70e51ba33cd947
SHA5129b957570e5f839cd3b8d2fc701122bef106b485ca99647120d5d31c73e539093ee743fb6a8c72659577e3f9c30f5f313d94b7f06760f68c3825dc7ac5c578f8b
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
676KB
MD51b3426f11c815f6e9f1b74f1c5c06dbb
SHA1d0920805c99c741fdfcd90410ac397488d8201f0
SHA256f0c94d075ba1473fc694d438ba73e27cb65e684f2cdc1830a1ad828d7b416de7
SHA5126b52bf448ff90c508626938931d8d1d6f541ba7c37720794f2f5ec0bb58cb923b6b7eabae525e27aecbabd253dd796be2bae0704bce1ade5955db7b898eda1c5
-
Filesize
680KB
MD54b96de7e315d872bfdb6bbcbbd6e9982
SHA1749ac209ea0bbb8470b94d0a315e127baafd1669
SHA256af3e3b85a6d5b336fc19e7f35184adc86862f27f024d5cb58c459f42ca975e69
SHA5127a4e63a51ca55c4ad254cf91dfacd049392ddf82ff093f6e15edd0eadfef99f5a892b739986fe79fd9f8d7e34718bef632123de0c1f51199c88489899717ad26
-
Filesize
1KB
MD5acdc213b2de5585ddac6e4f34c4bd4af
SHA1b878827b5a7236135f7cca5bad0d96fe59854b2b
SHA25689986f497059274d4dc1753b6f55c12b3e179e8e95897378a6f05133a380a0b1
SHA512bef619ef1463281107e4d184a325b5caa5e92575f20e42788be86a19d1382d812fb8b2f571f0191d9520ddf2e96949aaed1d0a47f7aed26f6e4f76923e452e93
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB