Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
10-01-2025 20:33
General
-
Target
113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61aN.dll
-
Size
716KB
-
MD5
683224e2ae945630da894687d7bf3070
-
SHA1
94cd595c69ccccf0ea1c153293de4cf30f6b296d
-
SHA256
113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61a
-
SHA512
78e54cb31c1e64346cac76dc4a1bbca0cd73c61339b46411381264dcac29e498789da17eb1cd2018bd1cb336ccaeccae0c1cab46614422f2ab44f072f20e26ab
-
SSDEEP
12288:ROCRucgLs3bu9FRcOL5yEPAIiCj6ELV32KrXZiQJ8cXFpoT:cCroYbu9FvAEPAIiy6ELV32KlF
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\113fdc288d8786754c54fa4f379ce7882b08d9c047b64055239aff889360a61aN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\ZUztpdJm\isoburn.exeC:\Users\Admin\AppData\Local\ZUztpdJm\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\ZUEEb7\AtBroker.exeC:\Users\Admin\AppData\Local\ZUEEb7\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\AAcrjtTl\dccw.exeC:\Users\Admin\AppData\Local\AAcrjtTl\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD5cb9374911bf5237179785c739a322c0f
SHA13f4d3dd3d58c9f19dfbb414ded16969ebd9f74b9
SHA256f7f3300b78148a34f6a35796c777a832b638b6d3193e11f4a37f45d4c6dfa845
SHA5129d47521538148b1823c0a17baa86ddf932f06f46d5d8b63fa87b2cc220fb98ce3f933e32d771222937bb8e41c88030839d489d1cd78b062bffeb2980dc6864be
-
Filesize
720KB
MD5b9e3c9a35bb6b3bb7de0a51eaf152bda
SHA113cbe6b3685f69ad817b701ae68debbace9a6f31
SHA2562daeb4e885cfd709d9fcce8ccd63538c76ee74a2ede71e9c74aaa88cc8c5cc08
SHA51238ff2902cf2c6361cc7d17e2fbe94b565931b05756ca8390b13ba112a99fb9969eb5619111d7be97d77bdf99f54f2dd4858ac1c0b241a5be45976b00b340c4a4
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
720KB
MD555b1f51565b133f00693d711dbb53424
SHA1cbb12c910b939ed5656d0d700b368a7260c56e46
SHA2561ac6f408430a710a731324b3eccddd5f69e5e3c693eb085de97183fc677f1c27
SHA512d33617cf46d96f2d1ca6e0928aeaeecdb77a48ee5087e902b0b3b0b2710106755cdf5d286ad181f19c9ea1e4d8284d751ac787718f19726df23243a9d1089601
-
Filesize
720KB
MD50ccbacbf71b18f5cffdd4c47f6db277e
SHA179b1ed4c434be50b9afbd933db2450d806bc4384
SHA2563357fcde0313afb8d791b05c42efc780d581ea722d75e345f333e1ed580707e2
SHA5126ac3a07d825ab8c93b353071dc218f455b72b8e9fb5df3acfbdb77eda35167ba713c47087af3adc5104a2114b8fe832ef26be9f6789746e2ea5d1727fbc3a687
-
Filesize
119KB
MD568078583d028a4873399ae7f25f64bad
SHA1a3c928fe57856a10aed7fee17670627fe663e6fe
SHA2569478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567
SHA51225503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1
-
Filesize
1KB
MD5bf2bc0becfb1d34dcc01b6f9f9ce95de
SHA166cc288c6baaff987c77dc5695d4afdc34bcd0a5
SHA2561dd04c859cf132b2eb833bb90b57f1b35eaf5ebdb4ddb590131fa76a6119d83a
SHA5126eab632054ed4e0eb1625309df58e492f2413e870bfc5bcee3106cf91ff4cedf55c880351370e60f2fa30c6ac95741f8a125168ae708a4abb3281e009297ff8a
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
720KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
64KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
720KB
-
Filesize
28KB