Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
10/01/2025, 20:33
General
-
Target
113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61aN.dll
-
Size
716KB
-
MD5
683224e2ae945630da894687d7bf3070
-
SHA1
94cd595c69ccccf0ea1c153293de4cf30f6b296d
-
SHA256
113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61a
-
SHA512
78e54cb31c1e64346cac76dc4a1bbca0cd73c61339b46411381264dcac29e498789da17eb1cd2018bd1cb336ccaeccae0c1cab46614422f2ab44f072f20e26ab
-
SSDEEP
12288:ROCRucgLs3bu9FRcOL5yEPAIiCj6ELV32KrXZiQJ8cXFpoT:cCroYbu9FvAEPAIiy6ELV32KlF
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61aN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\hvfit\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\hvfit\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\j2n\SndVol.exeC:\Users\Admin\AppData\Local\j2n\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\notepad.exeC:\Windows\system32\notepad.exe1⤵
-
C:\Users\Admin\AppData\Local\u3P\notepad.exeC:\Users\Admin\AppData\Local\u3P\notepad.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
924KB
MD51907509d5c79c9fccae9b6f9b2c14cea
SHA1f837f19f3f21e1dea6ac87cb4f56d2acb14291d0
SHA2563376a1755364fe0a587b619bccb44fe1321c1330148d7b2d6bc4611145bd6db4
SHA512c650466a016fa9830518b7f0f0a83a324d55ba69ba3f13bb1c7938d28ee511d991c9b8b34f285f5a45b0ee6ae4dc7783d49849206f4958ddd404bb1582892be8
-
Filesize
720KB
MD5b98c41db89e580b2a6cb81485de2881b
SHA1b0a03e11dc5e6f048f7468723972e6438bc9e676
SHA256db9bfa06bd36c5f292ff53ed927d3bd163b9a96a5c96552c84d8e6d4f28b1a88
SHA5120be05a3c4d0decb859cafc68ce725d086b1c56ee7231db9d56ea62fd80b616177b61fa1ec8011f6f18b7e773d5e97c49339379bb0fd9063d39c88edab6d22d8a
-
Filesize
720KB
MD5fa5fb00a9e58b3be7a9559b47cf20fb7
SHA1164bc022752b77d8d6b327c19cb3c57e60bc83f2
SHA2564d6bc848927787abcffcff8f524817bfb3ece197f49e2f16342e6595028f9e01
SHA51297e02b5f2cb93646139ea3d9703b71d7202f026ab105b70d1483b3cf55c3c5c0579711837b6e2bcbee33bb9d3af691147e5d3b7dcbad484f99eacfb6a06646a1
-
Filesize
1KB
MD5e0e43a720a66abdfaa621e72b6c01a00
SHA15410af680008f4aeede81cfca8049558d6877131
SHA256b7e5375034188127e6c436fa94fac30195819d2338c45c50ee7a7c3c0a13d50a
SHA512080860ddb12b05841c9ee791a74d3cc9a1ec2c544fe4ebe33c51fd552445fcce5130ef8d083672edad3d24799ed01538e7f8ca3d5ed32e70993ab47bc11194b6
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
267KB
MD5c3489639ec8e181044f6c6bfd3d01ac9
SHA1e057c90b675a6da19596b0ac458c25d7440b7869
SHA256a632ef1a1490d31d76f13997ee56f4f75796bf9e366c76446857e9ae855f4103
SHA51263b96c8afb8c3f5f969459531d3a543f6e8714d5ca1664c6bbb01edd9f5e850856931d7923f363c9dc7d8843deeaad69722d15993641d04e786e02184446c0c9
-
Filesize
189KB
MD5f2c7bb8acc97f92e987a2d4087d021b1
SHA17eb0139d2175739b3ccb0d1110067820be6abd29
SHA256142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2
SHA5122f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8
-
Filesize
716KB
-
Filesize
8KB
-
Filesize
28KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
8KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
720KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
720KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
28KB
-
Filesize
924KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
924KB
-
Filesize
720KB