Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
19-12-2024 19:36
General
-
Target
055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded.dll
-
Size
776KB
-
MD5
5275646a6840ccb66702495f74f2bcb1
-
SHA1
7914b808819e702bc2d457de368310d19496e7dc
-
SHA256
055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
-
SHA512
2ac366a058c1800216e623cce710cc1c42fb942e304365ba9a7eb6b8e6000c7ba2d639210e1f5bf4927243105edf105ee5d3913fe936df68ee0a9270f670c31f
-
SSDEEP
24576:pWyonFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:EHuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\HoFATl0\dccw.exeC:\Users\Admin\AppData\Local\HoFATl0\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\43mN7z7o5\omadmclient.exeC:\Users\Admin\AppData\Local\43mN7z7o5\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\QsbCxcx\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\QsbCxcx\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
776KB
MD57036d6dd8b6326b7e7e50cc659b57848
SHA11f0addea7612d34ebca6bf34b51160b4aa6ae01f
SHA2566537d178534bbad006e9080fcc2833ae306c9ea38c86ebed63174388d2bd6b91
SHA512b9ccaf60db629b327ee0594e1648ebfc790fef18075e2991d1d19952259ec2837ac8fd272264b2cbd8f2fd5fd6855a6ddc264110de4347590a75f6d71c410fa8
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
784KB
MD55e4f1ad3af3ab11a16b7c2e8dc0d5048
SHA148f8d11e519dd4f52f743cfd3fa8561aa238e9a4
SHA2568d034d5030ca8d80f3098cf2d200f26fe97b6484c3947bd01bed685130469775
SHA512d2ef94045b51fbeb79c46dd4f2e406c0a1de232eb061a4c59d6505b21f79b283249cc5d02efb7e39531643281823a032a77a54a0d1a089e957f443c1807a3c3e
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
776KB
MD54fb332d3cf7fbcae96fd6ae9d001af83
SHA1b1ad99590168ca90eeae58d0bb934610e7d64467
SHA256b70b432443619536cdf175418651dd56e81bf2452182451c90e14c5c75e347e5
SHA5120e4b3a505632f9de8daa9edb694911ee11bf748fd596dde454ff2dbed52d880b8574785b6ec0006718be0766422b1fc375165eb3765fbb399c98973bd300b549
-
Filesize
1KB
MD5e6bd20cb74446c43c8dfe5401576ccfe
SHA11fa816711afad1938e388d616959e575843ea002
SHA256e18bede69453a84f94157f45b67d6f0aeba44c11cae1a2e2fe064b2054c20c12
SHA5124c18d977ea33a1c00700b919b011dc7288ed0a42030c78a43bcd0a5dc2509e16f8289aa6eb1092e2592df8e7dce72c4322d8747183373e356a85a89e329bf64b
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
64KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB