Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
-
submitted
03-12-2024 19:57
General
-
Target
853fd5a309facb5739f2b61179c602a459515520a8ee9b884ec8fbd636d966fdN.dll
-
Size
768KB
-
MD5
4036dc41e4bc5c472e86a2dc02c292b0
-
SHA1
c14cf9abcf8e5fafc902fa201cb179e5fe4c4a34
-
SHA256
853fd5a309facb5739f2b61179c602a459515520a8ee9b884ec8fbd636d966fd
-
SHA512
a6a13d5e17af68104f7f2f5ddd06737c41bc23b9ca0a67908c643c6dfe9ec57b1562bc576564e07bc060c0620328741e92688e6b3faee16c1cde33abcf582d14
-
SSDEEP
12288:66BBWGJW6eC85Df97+yXUj7SncCxj8iHGo59S1WQSCtEdFO7YKJf6:66BQBjlc728jo7S1bl6FbK
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\853fd5a309facb5739f2b61179c602a459515520a8ee9b884ec8fbd636d966fdN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\8GhoKy\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\8GhoKy\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\bPopUo\FXSCOVER.exeC:\Users\Admin\AppData\Local\bPopUo\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\SOsXb\rdpinit.exeC:\Users\Admin\AppData\Local\SOsXb\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
MD58923f00b2c4278b4318a1e586ea5d3a5
SHA106a0186dd6b7ef2a597375ac624cf3fca91f6ddf
SHA25645e5a28cddeb7c9fa0a40a7c6887a14a9e1bf5af6b17df6c3d3b3726b91cb95f
SHA51259b2a953b42259d8d84d24aa5dc76d9b09147b73c8036e7c6edc4e60d7f7208b9d3258e8df6597398bb00d8b47bcf4368e3a351e98b5b746d1c94a9b6e2cfb79
-
Filesize
772KB
MD55be918a9959467ddd7b368958aa24c3f
SHA14275692164b1912e037ad252ec585b4e93a6715c
SHA256e9732f1737652ba5d5cf721b6960509f7456d02c93065db5b5772171fa889d42
SHA5121df5bcfe9390951da71594ce86da4355a440616ad7ba6350dbba27f46579ec4b49b932357deb9cf2d9fe5cc6c9231f2aad76bd9e5a4eabd2dddc3fdb0b35260a
-
Filesize
796KB
MD5c521476e4fe6481225615b42d0ebba6d
SHA1c51339126ab8680c6d2dd6c2b6ed007c4d604aed
SHA256e7f72ecf9aee9d2c6e0090ff47d0d53ba53504f233b49a07cb3ee2dce8f64efb
SHA512436423dcc68cc20728f8328127d0dec12d70dcd52e2bcce807ee658481294893862be47996ce7809f318e0947b75e0c6d5b25226b11a553ecab0ff186489fb30
-
Filesize
993B
MD58fc12c4b51fae87605b3303886810f31
SHA1ef379f8e746516e780f9c61cf4060ea023483a53
SHA256aff562f5f6889a1684f0fd722a4bfefc3d5f3b8b5920322e68c43b1a176683da
SHA512a395d4944cdf42c63fac9bdbb844a5575355c0820ef886573c1f5e8f65c5822073e943c6221c9ecd8fcdf1a1eb706c286f502b547052a060a9e6c9ed78d126d2
-
Filesize
80KB
MD5d0d7ac869aa4e179da2cc333f0440d71
SHA1e7b9a58f5bfc1ec321f015641a60978c0c683894
SHA2565762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a
SHA5121808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB