Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-11-2024 17:10
General
-
Target
39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be.dll
-
Size
672KB
-
MD5
83907ddf64aa95e7da9c6e9758b2610c
-
SHA1
8c096240c45f1b4c05d8e07a1b5df38615e54aaf
-
SHA256
39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be
-
SHA512
6d7bab6de77969b6f01fa03a95dbf371a0ec03ba0709a4118a71550b126aa7eb1cd55c161a8f898a131da9a10c79730f52c3950073a32d0157c5eea3e9c92688
-
SSDEEP
6144:E34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:EIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\jYHM5\rdpinit.exeC:\Users\Admin\AppData\Local\jYHM5\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\hAv\PresentationSettings.exeC:\Users\Admin\AppData\Local\hAv\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\snnnt\DisplaySwitch.exeC:\Users\Admin\AppData\Local\snnnt\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD54947d24e293553fca2e376537b5ea3e4
SHA187764e9701fbf02e1ac1979d7ee7a6e78447b32d
SHA256d079cb87e81a05eeb434b570a67aab43aa397dc3287eb27835a6c11e8be15283
SHA5125da71aea4c407bf44d5ddf61d7f224508ccc1ce2a3832e286a2e1a1c27cd19eef5bf99f9f76a92944712d3080d588888ed5f543333103c933d7178159dd6cb90
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
676KB
MD580f0bf41abfb2094b703acd7acee8987
SHA1d4e17f506be0407e1878b50505ce14118925b5ff
SHA256bacf1e130030cacfd87450f5f55af81ad3a838e02dc2bd6bd8247d6548ec17d0
SHA512a4c2cca78ea60178832b17123c2ccdec55230a8bf4f264c413f52163f52d9ec960b3535732042f77ff83296f0e0972a7fc5e183540c5c52ca514b11865ea1320
-
Filesize
676KB
MD5bb5086381539ef29a3a64cc6cea7c4ea
SHA1259034d162cb5daef9a738dd8692f10d5d828aa4
SHA25645a450e9e1af3d581d712915580aab1a8fc1cc52301e9d01c6adbd166495bf10
SHA512267ce55bf5412a340d79741aafe91b819278aad84c013e51a5805b7f9199580e527898b1fabe60c0814ef05a174652b6e137c291dc0865ac3b2b155efc0e21a6
-
Filesize
1KB
MD5e3441f8e1fe65f4e2e731617cd4151dd
SHA1c78d03b900d7a6a87192564d1c15a7dbdacc5ff5
SHA256aec98797ae312d3856b10fa3058fae65afef9c04e92d067e958c2df398774772
SHA5127c129c0935c34052ebd57bef5197a3dd48229af0c578ec4abd3a37b4d5f52e918577095f6a554716110a1c6b8a63bb981bdae8fad81d9ae9b96582be3fa5eb3f
-
Filesize
172KB
MD5a6f8d318f6041334889481b472000081
SHA1b8cf08ec17b30c8811f2514246fcdff62731dd58
SHA256208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258
SHA51260f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69
-
Filesize
517KB
MD5b795e6138e29a37508285fc31e92bd78
SHA1d0fe0c38c7c61adbb77e58d48b96cd4bf98ecd4a
SHA25601a9733871baa8518092bade3fce62dcca14cdf6fc55b98218253580b38d7659
SHA5128312174a77bab5fef7c4e9efff66c43d3515b02f5766ed1d3b9bd0abb3d7344a9a22cbac228132098428c122293d2b1898b3a2d75f5e4247b1dcb9aa9c7913b1
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB