Analysis
-
max time kernel
152s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
17-04-2022 16:35
General
-
Target
7a4e011803ef96e8fac69078841190d9b2e70a8e7b46503763f198b56610a47a.dll
-
Size
1.4MB
-
MD5
9ddff2357afda5654a8d78e9619cd3c6
-
SHA1
d424194ee2151aea827f7ee24893ee6731982385
-
SHA256
7a4e011803ef96e8fac69078841190d9b2e70a8e7b46503763f198b56610a47a
-
SHA512
b9884ae6ba552cd19352ddc4c556de6a3792693c01b6e25723b5a3667cdf23daf4478021d9e55e340af745466111424f506cba62896a20ba7f9af6e45acd3b07
Score
10/10
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Modifies Installed Components in the registry 2 TTPs
-
Checks whether UAC is enabled 1 TTPs 1 IoCs
-
Modifies registry class 5 IoCs
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
-
Suspicious use of AdjustPrivilegeToken 16 IoCs
-
Suspicious use of FindShellTrayWindow 25 IoCs
-
Suspicious use of SendNotifyMessage 21 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7a4e011803ef96e8fac69078841190d9b2e70a8e7b46503763f198b56610a47a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1272-59-0x0000000002980000-0x0000000002981000-memory.dmpFilesize
4KB
-
memory/1340-60-0x000007FEFC511000-0x000007FEFC513000-memory.dmpFilesize
8KB
-
memory/1944-54-0x0000000140000000-0x0000000140170000-memory.dmpFilesize
1.4MB
-
memory/1944-58-0x0000000000110000-0x0000000000117000-memory.dmpFilesize
28KB