Analysis
-
max time kernel
120s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 11:12
General
-
Target
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll
-
Size
724KB
-
MD5
755eb0def2568d37a1d149b3018bdcce
-
SHA1
e69c1d12dc3d2aa730aa8a9d94757c73777bd54d
-
SHA256
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c
-
SHA512
2ef40d5038c63489149fde266db0e1d440f45a4e8056353ef7e4a70c8df65917a782ceb139955af8cd814704b29c58e548c47c3e521b872fe8e62301d54301ec
-
SSDEEP
12288:KO3+ivi0RNOR/5DH2InMtdhtvX2tvJljUWcJxm/Osj3lx7l6X0k97L4HAF3itk:7vdvOZ9H2+Mt7tvX2tvJljT/mi1xJ6tX
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 10 IoCs
Detects 'dmod' strings in Dridex loader.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of FindShellTrayWindow 3 IoCs
-
Suspicious use of SendNotifyMessage 3 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\iU2kcM\rdpinit.exeC:\Users\Admin\AppData\Local\iU2kcM\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dxgiadaptercache.exeC:\Windows\system32\dxgiadaptercache.exe1⤵
-
C:\Users\Admin\AppData\Local\BbINk9R0p\dxgiadaptercache.exeC:\Users\Admin\AppData\Local\BbINk9R0p\dxgiadaptercache.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\dBI9cA\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\dBI9cA\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
MD54bf11c7bba2579ee06ac4ea97c9ed4b0
SHA108299031aadabfced962fbbef48711d4d2212928
SHA256cce6157d62bf884bab4739cd15c8863ede4023498dc705700f5407f5e7cdaf8c
SHA512ab9ff1e929bd3ff823176ae69cdfb18ecd85699721f4c373895a0aebf6bb9e5aefa7046f3b7bb5dd949475a493758069cfab72c7d44b3dab2bce343ac4e4f3e1
-
Filesize
230KB
MD5e62f89130b7253f7780a862ed9aff294
SHA1b031e64a36e93f95f2061be5b0383069efac2070
SHA2564bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5
SHA51205649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7
-
Filesize
151KB
MD530e978cc6830b04f1e7ed285cccaa746
SHA1e915147c17e113c676c635e2102bbff90fb7aa52
SHA256dc821931f63117962e2266acd3266e86bf8116d4a14b3adbebfade1d40b84766
SHA512331923fa479f71c4c80b0e86ea238628666f95b6cf61cf4d741ae4a27ea2b8c636864dfac543d14599b4873f3b2ab397d07c4e4c17aca3f3b4e5871e24e50214
-
Filesize
728KB
MD5d2b0ee1b72c646fbf88a50e461ccb884
SHA1586c56a5daeb444b994f73e802ffb86aa63aff71
SHA256f9bf39bcd6161806a7522f3c9b04af671868a3f82188559fe3fbbe884558cba7
SHA512fbe89b3baf2fe6423f7059ccb694d056d66eb0154f24a5c2640c58b4b55cd65aebbf6b03d9c37799174a7d04b4c478f3a6df58c573e2d0774a49cf336e18aa8e
-
Filesize
732KB
MD5af6d7d0af1de70d90e98ebdad4603fcc
SHA1faa0f0ce0e0abea25c2aa9c081e86584d76d2cec
SHA256af9ca9f7e1c5026ca84503564601121d0ee2075acdcd25bc44d6c93d47215d58
SHA512534b6dde27e318d7c440acea8bf4cb02d26fc62308429fcbfbd98068b1089a78492f3303c80a71394c9875df83df32149a7eadeaf41aa2e8df8596699806e915
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
1KB
MD56cb9b7339d5bf712cb92a6ab416ff970
SHA19fe6957e0a2a5966bd68f63f0803512292e92950
SHA256118f5b4265c832c1e3802e54ffb2c7b41b149463c3f631525317290e46d98681
SHA51255b0dd2dcac49987e3dba5f038d77bd1f23b9ab6458528a1f1befa682fe22433e16e206f70274f3838725faa2befbb955a80a644d3bd0bd44377c953bf99fc04
-
Filesize
732KB
-
Filesize
732KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB