Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
09-01-2025 19:47
General
-
Target
0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c.dll
-
Size
780KB
-
MD5
a7403fbba743c09ca421f165debe67db
-
SHA1
5adc0273eb1887ce490df360724ccc6e25abf0ce
-
SHA256
0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c
-
SHA512
2c05321dcd4b74e20352ddafd9b2598eaf3beae29215af310c07dad8a6064d8535ac81b4c0c70e01e0d29ef0faac8836f12bfba69da5100e952f34da9cda5c2d
-
SSDEEP
24576:4WyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:PnuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\0b0ec7eecb4b63062e0d4735a65313574f5c783b0c214d0a260b0112dedb216c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\qEq\mstsc.exeC:\Users\Admin\AppData\Local\qEq\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\Rphj\rdpinit.exeC:\Users\Admin\AppData\Local\Rphj\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\GRf\isoburn.exeC:\Users\Admin\AppData\Local\GRf\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5742917f9fe552d58989282b5e9be678a
SHA1ff916bcfe05bb581fc9c717fc077e4d917cc98bc
SHA256721473daa634c17ae2f8c7be521b9fdbe54f66ef3e5ac29faa2850422732c42f
SHA512b1cbd7ea6cd89dec365d33147a3ccfb0443466f419d533773187e0061bcec2aa1f0e95c6e4e693d6a55a68810305ff90850fda7c89a9cb3b66458d6a89d9b94b
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
784KB
MD515e0dbcbeeb6ea9fbbb9ce97a854b5fb
SHA1491a4cfa23c7fbb41fb29d595bccfcd5b434911f
SHA256ddddc194dd8751b0e7ae9f759d496448598146e842ca977b583f8c08cae3eca6
SHA512b460d06726672f480315a7b6caf9e11f2effd49b17aa34f263c9f56516137d3c5afa1a409332a79229b5a1450e14ef9bb4ccf3d708afaa867e08c7ba2164c498
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
788KB
MD58056b9e3461ac8052e67f0d519739dbe
SHA11d681a252a90429340a59b69d1af80822eb99990
SHA256d56ea26d99b9fce88dd895139176f5ccf255e1e542eea0e007c1cd51f2fc0b70
SHA512ebe026f87d86ebd8ed6c4f1568340f2fe2c04e81a0a79d63598b30f077615d930225cd66c8f7be9941768652a521fd25b8dc435ec46097fec221399eeec83baf
-
Filesize
1.5MB
MD53a26640414cee37ff5b36154b1a0b261
SHA1e0c28b5fdf53a202a7543b67bbc97214bad490ed
SHA2561d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f
SHA51276fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2
-
Filesize
1KB
MD53c1ba86f558bb626790c6cb03592100a
SHA1129d68324ccfd7832ee71e2272a71d3583add6b1
SHA256a5e812b43923d2d3ef0e88eeedb38b1e4521ee41823c7312b4f8781e309551d9
SHA512fc655fd0f1ff41c4caac3f8c159361f5769f78e558df04693a78085b6d2c94337cffeb6e63b3c7c9160f4af493be53f96d9d7b2f9c488042844014989ed641b6
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB