Analysis
-
max time kernel
149s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-11-2024 17:10
General
-
Target
39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be.dll
-
Size
672KB
-
MD5
83907ddf64aa95e7da9c6e9758b2610c
-
SHA1
8c096240c45f1b4c05d8e07a1b5df38615e54aaf
-
SHA256
39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be
-
SHA512
6d7bab6de77969b6f01fa03a95dbf371a0ec03ba0709a4118a71550b126aa7eb1cd55c161a8f898a131da9a10c79730f52c3950073a32d0157c5eea3e9c92688
-
SSDEEP
6144:E34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:EIKp/UWCZdCDh2IZDwAFRpR6Au
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Modifies registry class 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\39c3ba8e5a0aaf8719fa57d866f02bb2dfae2474a42b6ae346af16a73f92c2be.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\Ka9rRxpn\Utilman.exeC:\Users\Admin\AppData\Local\Ka9rRxpn\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\OptionalFeatures.exeC:\Windows\system32\OptionalFeatures.exe1⤵
-
C:\Users\Admin\AppData\Local\VWJ8Z\OptionalFeatures.exeC:\Users\Admin\AppData\Local\VWJ8Z\OptionalFeatures.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\Z2M4i\sppsvc.exeC:\Users\Admin\AppData\Local\Z2M4i\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
680KB
MD5c8a929138d104b875b23b02a249b546a
SHA162b4533637b4edd884fe8fa4ffb2182ce1b8de53
SHA256a9e74e7dbae6033ae1f3b2c9c9bb9fb3ad531f1cc694031a1ecb2324a0cfa52e
SHA5128b7ea71e317676fac72b4415c006ab2207b7973847e2c281faf877d158738e42b728407fe7d3ea3dc10ccb561bdf64e6740a213c7a2b8dec29c9d950551d1e03
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
110KB
MD5d6cd8bef71458804dbc33b88ace56372
SHA1a18b58445be2492c5d37abad69b5aa0d29416a60
SHA256fa2e741416994f2c1bf9ef7a16b9c4dbf20c84267e3da91ae6f1ad75ee9f49b8
SHA5121bed8af2cf99a7f3bb36a34f4a71c34787904bd072ecdc731fb7498290dcf4024b956fb8b6912ad050b74aa861f0b0349081b77088f72732bda5075413b1f83d
-
Filesize
676KB
MD536c18951b80f65ee0c78283448d1c850
SHA1cad4df328db309004a48b6372dde831e0f16e384
SHA25693bfde3cf06750984e3328e9cbf117953f6dc90642d5a09c9d6764c553271bd0
SHA512218bf3ee011f43a8912627fb4c68dca3edc038fd6d74cfd4d73e88b512c12215690bfb7106610ccc006addf6d7c16e35c56bd8682fb7547a4062a9f63a020a43
-
Filesize
676KB
MD52c5b9a6ef2cada1cb0d529a2b3ba2e16
SHA1b019621884809cf1a1d0c5520d1e951d0f702044
SHA25687fd767cd22d324fb46d6bf8d91b78389436ab96dc4bfb375484667bbd32986b
SHA512cb61c50e719571e2255e829b759d7db2a61bb5c5858049b4d6dcfd57023b134211de7c86870590d9619ec1c29da5d4c96290145edf78546563a3b478c09e4b3b
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
1KB
MD502dc0d36ea7adbe8ae9c2867983e1b02
SHA1024e4d4d83cf25153847e8d61d5079188973fa21
SHA2565e60bf18fc223571c17a5fd4dd97939939a6723782fc6c726cd2f72c6ee272a1
SHA512293a99da0532c236a0aa2661b910efc8bc44d6ccfc96bd41ffaa28b7e79e09d6dfc4409025f9f751f4c71040d5194c11aac7f69645d2de055da4bb0e46d31048
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
680KB
-
Filesize
680KB
-
Filesize
28KB
-
Filesize
676KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
28KB
-
Filesize
672KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
672KB
-
Filesize
672KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
28KB