Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
30-11-2024 15:18
General
-
Target
af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d.dll
-
Size
1.2MB
-
MD5
304109f9a5c3726818b4c3668fdb71fd
-
SHA1
2eb804e205d15d314e7f67d503940f69f5dc2ef8
-
SHA256
af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
-
SHA512
cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
-
SSDEEP
24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\Z9eTuJ\msinfo32.exeC:\Users\Admin\AppData\Local\Z9eTuJ\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\Ft260\p2phost.exeC:\Users\Admin\AppData\Local\Ft260\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\Einf\p2phost.exeC:\Users\Admin\AppData\Local\Einf\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD525c1a66ee70f968bf0377020a56966ae
SHA14c4c4de73e8a1951f8f57e4d28889fcfa98a1128
SHA2566df431baa5d6b673e6a060e68cb9f9dfbe9ad79cd1798895c98c346c0e61d370
SHA51274852eec1e9649ed6b161512f8a74eb757bddb560981727d8cf880235cfd4cc077ecb509463c00affd8bd870603db977087bac05caa6a2931c14e6ac05bd8a30
-
Filesize
1.2MB
MD51c4d4c6e7467fcd2e052e22709a70185
SHA16e512323231d2948f4023f5c46b3b2354c6fdfa2
SHA2569c495c8315f332c89879ceead285c93886d72c4c06ea7caaaf35023bb5be4bcb
SHA512d7396e14840e3e58f8b1b3709542ebeeb8183ee054d3711df642a6b79fa6839549799dd0801adb3f610bb021eb513e4fc3fad32ab960fac8c7dfa035c51500e4
-
Filesize
1.3MB
MD50bdb32eb2b17a4b1b9fe3df1753dcdec
SHA181e86b2a51edf626cc3ba1044f9fcc55f87fb0ae
SHA2561ceaf5b35975773e20632b894143178f3ecdcfc7f57072c334dfaa4246f98ff9
SHA512db1c78f293d3e4a388c54a13e345a83fd544beef0d12a4d7629c09e5da7c2f965583c1967208e3caf362f56b98a5dfec5863f4f1f5c81cf6d359950cbe3322a2
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
735B
MD5c3218dfd6b5bf5bf3e6b78b51234d9fb
SHA1ebfd81271b728f23ab3d621e610bd902ab1295dc
SHA256f933c88719ea67be9b03f064a1699277147a939993d3de0dd53ce31befe35216
SHA5128acf01ca47e8c1a91239d2d41e4d624b53c42a2ae607e9766d8dea0ab63e8dee29871ba03bf0f33c82b2e2ba53e9ae786810d97ef519179f507c7b6b9067ff55
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
8KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
28KB
-
Filesize
1.3MB