Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
09-01-2025 19:47
General
-
Target
0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c.dll
-
Size
780KB
-
MD5
a7403fbba743c09ca421f165debe67db
-
SHA1
5adc0273eb1887ce490df360724ccc6e25abf0ce
-
SHA256
0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c
-
SHA512
2c05321dcd4b74e20352ddafd9b2598eaf3beae29215af310c07dad8a6064d8535ac81b4c0c70e01e0d29ef0faac8836f12bfba69da5100e952f34da9cda5c2d
-
SSDEEP
24576:4WyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:PnuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\kMXPSdHL\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\kMXPSdHL\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cttune.exeC:\Windows\system32\cttune.exe1⤵
-
C:\Users\Admin\AppData\Local\v36VJZmZ\cttune.exeC:\Users\Admin\AppData\Local\v36VJZmZ\cttune.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\0N9iomQ\consent.exeC:\Users\Admin\AppData\Local\0N9iomQ\consent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD5a2966e0cc173a2ecd91ac32f2dd9ca73
SHA110ebaafd4348fb9e589eb01fafe4e04dff80c4ab
SHA25619d0fa520c4be5cd6852888500d9e6b14424dfdc3df64baf6d6bb50de41abc44
SHA512336e4e8efe2be3c2c0bbe16d6f102872bec644679fb1777b9e10539e9587e9b29818ee2fb16b461b777c7b80c497459f106c821df81d075e63de2a6f29576837
-
Filesize
784KB
MD5ce6bf3097812cdd98dd6819f1143dd11
SHA180aa645ff375a9f0b660af9205892f677dae8143
SHA2567543b194524b8e33d71a0f2f718e1a969b06dcdb8ea25255acf7e5cfb3c29ee6
SHA512832208f4d3c9921b434a4797ec3dc01a23681fff717648e8750671289ac131f3a544e8614fc9f051525859f9d41e4ad766db4b73be0775ecfebec52c0d17ae72
-
Filesize
780KB
MD578053fa1079a5a2ceb4d1c4f9977dd41
SHA1e3ce0d50530789c30bad7989963c6e2589b9aaf7
SHA2567f51348cccb93743bd774ca5136b478d8541ff28db5d842c7df7bac201a21790
SHA512515c0f01f68b3b38c4b28b86eec365e4b80bca70a7af04b4906a446e051cf1d5f720784ff8f8354f771fef3bb7a47bacce9a728b465921dddfcee3cb9844c3bd
-
Filesize
1KB
MD59c6c8323428cb1232c85e236fc624509
SHA1d022d1f9874efb72da9b82c59499b789eeac84ad
SHA256c450edb642869e016df69bf3bd4a578cda5f585bb8e58fcda9b148523a0ac687
SHA512f858e4498ceec2906fe6422f62d60ac2d1b33d0e449d6c8ac2721bdd175c315147e50ab65aa03d83d2e7d053afef4219e4113e03b31d79712c690d010b461708
-
Filesize
109KB
MD50b5511674394666e9d221f8681b2c2e6
SHA16e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA256ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
SHA51200d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
314KB
MD57116848fd23e6195fcbbccdf83ce9af4
SHA135fb16a0b68f8a84d5dfac8c110ef5972f1bee93
SHA25639937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6
SHA512e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB