Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 23:57
General
-
Target
12e83b82323d48939373b00da810964eb14b176f112a61437dcc8b83483d789aN.dll
-
Size
724KB
-
MD5
16ff194261d802bb962f116de20281f0
-
SHA1
fe8d67b2362a86ad47bf63abf68ce997cdc42ea0
-
SHA256
12e83b82323d48939373b00da810964eb14b176f112a61437dcc8b83483d789a
-
SHA512
9cd53fbce376a94a99ea197bb2d8376e932e2c8a843708205c8c613492657ed1aa731b4bd4d3cdc1e4be8d3229865af7d0bcdeb655e44fd0f53560785be1ecf7
-
SSDEEP
12288:KO3+ivi0RNOR/5DH2InMtdhtvX2tvJljUWcJxm/Osj3lx7l6X0k97L4HAF3it:7vdvOZ9H2+Mt7tvX2tvJljT/mi1xJ6t6
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 11 IoCs
Detects 'dmod' strings in Dridex loader.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\12e83b82323d48939373b00da810964eb14b176f112a61437dcc8b83483d789aN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\EaseOfAccessDialog.exeC:\Windows\system32\EaseOfAccessDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\Stdn35l\EaseOfAccessDialog.exeC:\Users\Admin\AppData\Local\Stdn35l\EaseOfAccessDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\2oYT6lNQW\sppsvc.exeC:\Users\Admin\AppData\Local\2oYT6lNQW\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\OkA\eudcedit.exeC:\Users\Admin\AppData\Local\OkA\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
MD5da087ad145aa0230411e41d498b1c1e6
SHA1c3d9a49351f5a86f7369b1f7446842b4c043a8e0
SHA256f9d13b44d0b1fea35f2475296fd57467f68a2b24f02644429cbd1ad202feb31b
SHA512ba76785d604b2850ee1b1a2bf627131cbe0b41869519e56621df8dcd9099560766e5c582f5f25d17c5c8f7cb96de46902cdbae5cdd5d5787c6a5ac30250bdde4
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
752KB
MD52a9e596121c84d4dd5ac0ea921a9776f
SHA1843797e2e6b5250c3d9072c6a0367ee0df74b06e
SHA256d5f91119b1b92293df4c5bf58d9b6841b87a23d1f689787d7c4fdb84292268ee
SHA512c760607e1248a58f071510a081bebc71148b71f8cf09bffe88387e4f8c68b222f2689d6f3b66c62ffee6c7678c994fef70cfeded95e7e10bfebc74fdab53938b
-
Filesize
365KB
MD5a9de6557179d371938fbe52511b551ce
SHA1def460b4028788ded82dc55c36cb0df28599fd5f
SHA25683c8d1a7582b24b4bbc0d453c813487185c2b05c483bd1759ef647a7e7e92dfe
SHA5125790cac8dae16a785b48f790e6645b137f211c1587fb64ea88e743b846ff3a886324afcfef4bebc61f869023b9a22ba925c461dfb2e12497b70f501e6b79153c
-
Filesize
1004KB
MD53afe9a7d37a40a5904403642164da0c9
SHA1812ade6cc6b2765676507df52d7e7e0f29dd5916
SHA256f75922658dd68b3c81fac93e53f26ba5c5f6a30abeb28c48ee5c2de34dbf3d4e
SHA51226c42ba1af45d77eabda39e37f7b2da15964f7391c27e3268d674c2905bef44f76e51e66128c7c1d39a0d3b355ec545252da62b17baa60660aabe436690c0928
-
Filesize
123KB
MD5e75ee992c1041341f709a517c8723c87
SHA1471021260055eac0021f0abffa2d0ba77a2f380e
SHA2560b1731562413eaa972b373cd7388c644a3059940ce67eb89668e4073f3e068dc
SHA51248c3a8531df6bcc5077367cdf32af104c94cf7701118a85e8beabba2e9c4f511ae14e47b6d1b57d11a2bc1e8b4f6d5bacae27a8d16fcd09a8f9e0018f5a6370a
-
Filesize
1KB
MD5020c560ef7259ab493822093a6776b50
SHA150a880c3a937660323c11122e12c4dfb3f4d41fa
SHA2567ba51ec7dd75d2219335a21e1508cdf6f85f457ebb90d15c8b8a5262ce089569
SHA512fcfa5c9fb362ab81e99c05b21a63d650ec667e2d8eea58ad05c60d6a2a099e6045c737f3702745aec78695b42733f5ef34fec1e11f7e225df910c0f26dce454d
-
Filesize
28KB
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
752KB
-
Filesize
752KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB