Analysis
-
max time kernel
150s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-01-2025 11:19
General
-
Target
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll
-
Size
724KB
-
MD5
755eb0def2568d37a1d149b3018bdcce
-
SHA1
e69c1d12dc3d2aa730aa8a9d94757c73777bd54d
-
SHA256
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c
-
SHA512
2ef40d5038c63489149fde266db0e1d440f45a4e8056353ef7e4a70c8df65917a782ceb139955af8cd814704b29c58e548c47c3e521b872fe8e62301d54301ec
-
SSDEEP
12288:KO3+ivi0RNOR/5DH2InMtdhtvX2tvJljUWcJxm/Osj3lx7l6X0k97L4HAF3itk:7vdvOZ9H2+Mt7tvX2tvJljT/mi1xJ6tX
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 12 IoCs
Detects 'dmod' strings in Dridex loader.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesProtection.exeC:\Windows\system32\SystemPropertiesProtection.exe1⤵
-
C:\Users\Admin\AppData\Local\TOCKpK\SystemPropertiesProtection.exeC:\Users\Admin\AppData\Local\TOCKpK\SystemPropertiesProtection.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\vtKr6L\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\vtKr6L\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\zSHdNGj\spreview.exeC:\Users\Admin\AppData\Local\zSHdNGj\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
728KB
MD54b5fbec1fe5e6aaacbb5bfbc7bdb554b
SHA13f1a5bde867849c75afc7aa5aed5d8ae95c91eb2
SHA256869bde802ea34d6b2b4aacef1b915c262ab880433ae4157865b9eb00a3419888
SHA51246dfe2363f0cbeaf682aa3241476829f7f5777a421382ab364454ef1560198f30ab14cb9692284aefb7e8738fda8c7e3a327d9454391166643196eec100d95d6
-
Filesize
728KB
MD5852df725ea9e1e950d6ce8e8214f1fa4
SHA193985f1659102b8c5e19534222f6746bc57e0f93
SHA256ecc583a90edd13577998b672834526bbc51aeeca86ad5cfcf40095de0fadb513
SHA512b1c3bae5f3e5b4d58500c863df6631527ffbadc3c5edff44751f22b0b920beb539aa450d6f63f061d6606587e03315ef2ae696f39fdc556296d1b14af825699d
-
Filesize
728KB
MD563bbae183021656efdc6c2c194cd5aa1
SHA16375d700b40d849bb9107d2d1452960c7c7d5edb
SHA25612d01db33d0d3defb79352b4a93121db7e96cb3ae8dae82580bdf4430f3cbca0
SHA512da5c55f3b6596baa526843dbb08066d8758857c4ddd5a2752178e40fd49fd3b2d03f07d5a05b23320ae5db24b98a69b34e700dab526aed316b87b507c8a02e79
-
Filesize
1KB
MD5b5dfd9c0c9775de76c9195a195fdcae9
SHA133082eb8c02c04ecad1beddfb8c057007f013b96
SHA256c9c0929bce6141854b36c1028bc588a043b3bd510fc42fccf344f8f61f84e69c
SHA51221bd60010d5206e9f881c4f624ac71208000d1713e39fe2918a6dbf8bde0bccbb79e49621d105940c04223545938429690182e7c7a7f0992df210c2b3cf758cd
-
Filesize
80KB
MD505138d8f952d3fff1362f7c50158bc38
SHA1780bc59fcddf06a7494d09771b8340acffdcc720
SHA256753a43d8aa74341d06582bd6b3784dc5f8c6f46174c2a306cf284de238a9c6bd
SHA51227fa8c0af3d01f0816852d04693087f3c25d1307d8857a7ea75b0bb3e0ac927d262f5ac5a335afee150142fa3187354d33ebbcf6c3cd5cc33cb4e6cd00c50255
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
728KB