Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
03-12-2024 04:04
General
-
Target
d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df.dll
-
Size
768KB
-
MD5
778f2d03f6cc98beaa08661134555c8d
-
SHA1
0ffa709507e15bd9d1359a227e750c7f53651754
-
SHA256
d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df
-
SHA512
c664eec09008a98da234009e49465777b0112ef7d41fcf40aa88d7aa04fe49d067bc0f1d27e5d75d05c07dabbeab4e7a288d97f7b40684a1867d2854aea90e2b
-
SSDEEP
12288:66BBWGJW6eC85Df97+yXUj7SncCxj8iHGo59S1WQSCtEdFO7YKJf6t:66BQBjlc728jo7S1bl6FbKG
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\ayGd\DeviceEnroller.exeC:\Users\Admin\AppData\Local\ayGd\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\KhEzLT3\Dxpserver.exeC:\Users\Admin\AppData\Local\KhEzLT3\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\aijz\dccw.exeC:\Users\Admin\AppData\Local\aijz\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
772KB
MD55e7504e70f71064116c21f6971b87080
SHA169296798ed1ae7a7f69357a9bbeb718e6f68ffd5
SHA2567cb8435dbcc1efe907e4296afb5d814b1236476c5b1d8be81364ccc176431bb4
SHA5124deb1e0447441d6d4d4b2b71fef950bc57728ce536bd3ce4420b9b9bfebc8ea9275e7c1c93da7e206e6243443c0d665497a230d9011ffb1de622c32ccb70eeef
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
772KB
MD516dace7e73d9f5a190b009968ba4d268
SHA1a2885291ff66872de555af45f280feb4f0fafc6d
SHA25603a30785ae7eb5ab78d9665b432b61359bf2f8707f012a8c749f117732eb5850
SHA51215f445fe8793c1f4da19f830baf08acb5d75d59a52b7c3a4fec6202e0d7373d41984206914980a83361d3191307b6e76ccf0a88a60002e2f4de8c94423c119c4
-
Filesize
448KB
MD5946d9474533f58d2613078fd14ca7473
SHA1c2620ac9522fa3702a6a03299b930d6044aa5e49
SHA256cf5f5fe084f172e9c435615c1dc6ae7d3bd8c5ec8ea290caa0627c2f392760cb
SHA5123653d41a0553ee63a43490f682c9b528651a6336f28adafc333d4d148577351122db8279ff83ee59bb0a9c17bb384e9f6c9c78677c8c5ed671a42036dec1f8c1
-
Filesize
772KB
MD56dcb70245932a0a96fe5854e35aec909
SHA10ce16a0cce57754dcdeb282013c29724137c6e2c
SHA2561ed04e068027b251a87bb6ec1c9143e5430a933594f291f33ba717685f214177
SHA51258ddb475b68da4c18ed91a6d763f09a62d235b5f5130d04c1aef337b0c4a721827a1da5b0474bf4cdaaf00134ff2cec4c115f32a63cf60bd5f4ef4e500c082e6
-
Filesize
1KB
MD51b9fbf6b0833a245d1d3db7d4af02e36
SHA1557abfa362d4a97a35dd5f80f7429b6451a1d860
SHA2561ccbb87da1621a66c624a0e71c55c0bb526e41c411bcfc2a6720a86e28565457
SHA512ed100c69d1df538fc305547455651452064409291f6d07606d2c90c92e101921d048137054a9a9de65698b22586867b942c2f056d7a69daf833c100f4e2ac8e7
-
Filesize
28KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB