Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-12-2024 19:51
General
-
Target
055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded.dll
-
Size
776KB
-
MD5
5275646a6840ccb66702495f74f2bcb1
-
SHA1
7914b808819e702bc2d457de368310d19496e7dc
-
SHA256
055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
-
SHA512
2ac366a058c1800216e623cce710cc1c42fb942e304365ba9a7eb6b8e6000c7ba2d639210e1f5bf4927243105edf105ee5d3913fe936df68ee0a9270f670c31f
-
SSDEEP
24576:pWyonFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:EHuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\JysA8IqAh\wisptis.exeC:\Users\Admin\AppData\Local\JysA8IqAh\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\iI0jIBwK\dvdupgrd.exeC:\Users\Admin\AppData\Local\iI0jIBwK\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\xpsrchvw.exeC:\Windows\system32\xpsrchvw.exe1⤵
-
C:\Users\Admin\AppData\Local\Iza7Usz\xpsrchvw.exeC:\Users\Admin\AppData\Local\Iza7Usz\xpsrchvw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
776KB
MD5727206f2b75ae57f209fef9bce568766
SHA122fd901438a3860bb4f0978ec51e1a75dea3201a
SHA2563fa37cedae09bd27c0a0616e69cf4263b19f6f637472a2490a53394967f40841
SHA512da964261703ef50002c87e8f55f72880004dfae5067b2f671c0ab53f7560841949602fbd314eb84e4df063a0168f2233fa27d539663049cb5a15b4cef91b69e1
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
995B
MD592c319f4bb83eaf67387fc9a36e90140
SHA12875c15f771545659cbd988b45afdf6c1859e4b2
SHA2564c6caaebf97285fd3cb435d1fcd66257f444500cf470329e7b3fda9cd576c659
SHA512bc0bfeb640d327485febd492860184efd43acc88898f495bde22347878fc6593dc8a0ad768b43a3fd22ae380ba6f1366462c58e425dd013d8bf043e277c26273
-
Filesize
784KB
MD5e1facf9e590da6bfa91b99824344aba4
SHA1a21bd8167b9b47defbadf8887479a33192e6d047
SHA256c6e0856dad386c4451fc19ae1f8a0777b72a8b55f9068958aeffda2f7ccc252a
SHA512ecbc38f848905912a7ce6c5797279971d4ad93d833a642babeefed81794f2cae9e1742dd0635ced149ebf00ee262c477bb420ce8eb7a7578750e39b4161d231b
-
Filesize
4.6MB
MD5492cb6a624d5dad73ee0294b5db37dd6
SHA1e74806af04a5147ccabfb5b167eb95a0177c43b3
SHA256ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784
SHA51263bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835
-
Filesize
776KB
MD5962ed42b17658687347af00d7e076ad1
SHA135b3b7f3be9d2ec49f1a43df7e9b234900c102f0
SHA256bf9faecd53b86c0e1f52d1abfaab635445f32a89f48ff3cfc39f983d5832a0d4
SHA5121980f6bdb2664fc128fbfb49714ed6540b41d23300d90c8c1918567970777dc08b81744ff386610261184f9678104bf86fe6e349a420829e996d649866df4c8d
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB