Overview

overview

10

Static

static

3

0d5ca4f77d...6N.dll

windows7-x64

10

0d5ca4f77d...6N.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 15:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    0d5ca4f77d6d22dbf3436f39ce5124eb658028f8221afcf2c61a7c5f7ec84606N.dll

  • Size

    612KB

  • MD5

    5a287791adac2393d92b451658169d70

  • SHA1

    a4b8790be5e611e758193325c3c96240c8613be2

  • SHA256

    0d5ca4f77d6d22dbf3436f39ce5124eb658028f8221afcf2c61a7c5f7ec84606

  • SHA512

    4d6adb6a897552e1d7c460dcd861b3eb533bb18c77b8570301ed17b752ec4dc5db7267ab02b5edab3cb10bf0b95d2d8b6f78b0de2d8366e59e6cb23b9ee1423d

  • SSDEEP

    6144:Eg12AzW5HsiScvtNybiR8g0ISTFCRVe9/JE+++sKS1JGWWsca65eu9K2zqc4CWA9:E82AK5HOEksJ1YW7DwzqyQY

Score
10/10
dridexbotnetdiscoveryevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 12 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 6 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d5ca4f77d6d22dbf3436f39ce5124eb658028f8221afcf2c61a7c5f7ec84606N.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1408
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\0d5ca4f77d6d22dbf3436f39ce5124eb658028f8221afcf2c61a7c5f7ec84606N.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4660
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2916
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2164
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:640
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1896
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3644
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4680
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2344
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of SendNotifyMessage
    PID:4972
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4556
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4212
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2280
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2252
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    PID:4152
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4288
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:4220
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:4440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
      Filesize

      471B

      MD5

      c7277c2e1d58e13b7e2fa92ad9192222

      SHA1

      fbe3c8589c006eeb54c74f752b548967a79a16ae

      SHA256

      3a21bb044616c603bff9898295f1cfc747b03a2acfed96234dda0f846801b504

      SHA512

      fc0114ed91dce6e8e225deffeb4b106a3343220a374f581cd59a523c6b798d4c3e8648114aba5e7ad13db5c0e2834fd670d45e8791bdf4a66ae28911687b19f1

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
      Filesize

      412B

      MD5

      6d7e9a6b40343a1eb3a7ef46c910d5c5

      SHA1

      a566ebc086fc9f94aebdac8bf0cf348acf0d9cfa

      SHA256

      33efdfe228f561b72f9003d743231ccffd08381b3f8b01b72820cff8acc3c176

      SHA512

      b784778d88dcabdca9e4ee51e2b5d8fae36cec6eb2af7861ad693104faf6c5a0a4d6f3ac5028268c6f849ac8d3301fd8a58969c023c9c22336dec204db23983e

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
      Filesize

      2KB

      MD5

      c4e7e19b87ccdfbcc12003c31dbee063

      SHA1

      67d64588d04ed10b31443a4ec91c6c87e751550a

      SHA256

      bf38440bab6d5c9e37cc50c9b58bbbc02b5a4a82ad230db2f266e23b8efd97ae

      SHA512

      873895a048233e97877385d565089199c9cd52ee5a6ba453072b426ab84d1aa4995f54270d22847281c6e7eb7124efcfe13df1b09a0f5cf2d7097fec54a6b700

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\2CFNWDLC\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      539db492f33fccee9be530dd0bf34a46

      SHA1

      650b2a3583d6c9499b4ed73e9a5dca37f342a50e

      SHA256

      f6d425aad05b46e77b53e5737c85f4ceab6531e773ea87eb985754be5ec19999

      SHA512

      9328f2fa286b4a9ca6ae57ddd9fca0b1140e5f68a5e143fd8ae6ea212a1af5d7b6b2289c324fa9480ca8d2e6d3b0cf7115611a56a3a161c5ad2f988f6ae62a0a

      Download Submit

    • memory/2252-140-0x00000172C6100000-0x00000172C6200000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2252-153-0x00000172C71B0000-0x00000172C71D0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2252-175-0x00000172C75C0000-0x00000172C75E0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2252-143-0x00000172C71F0000-0x00000172C7210000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2252-138-0x00000172C6100000-0x00000172C6200000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2344-15-0x0000025210B00000-0x0000025210C00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2344-16-0x0000025210B00000-0x0000025210C00000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/2344-20-0x0000025211BC0000-0x0000025211BE0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2344-51-0x0000025211F90000-0x0000025211FB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2344-34-0x0000025211B80000-0x0000025211BA0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3644-13-0x0000000003F90000-0x0000000003F91000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4152-280-0x0000000004A20000-0x0000000004A21000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4212-136-0x00000000043E0000-0x00000000043E1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4220-282-0x000001FBB6F00000-0x000001FBB7000000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4220-283-0x000001FBB6F00000-0x000001FBB7000000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/4220-287-0x00000203B8FD0000-0x00000203B8FF0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4220-292-0x00000203B8F90000-0x00000203B8FB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4220-319-0x00000203B95A0000-0x00000203B95C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4660-0-0x0000000000D80000-0x0000000000D86000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4660-11-0x0000000000D80000-0x0000000000D86000-memory.dmp

      Filesize

      24KB

      Download

    • memory/4660-10-0x0000000074C20000-0x0000000074CB9000-memory.dmp

      Filesize

      612KB

      Download

    • memory/4660-1-0x0000000074C20000-0x0000000074CB9000-memory.dmp

      Filesize

      612KB

      Download