Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
11-01-2025 11:19
General
-
Target
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll
-
Size
724KB
-
MD5
755eb0def2568d37a1d149b3018bdcce
-
SHA1
e69c1d12dc3d2aa730aa8a9d94757c73777bd54d
-
SHA256
21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c
-
SHA512
2ef40d5038c63489149fde266db0e1d440f45a4e8056353ef7e4a70c8df65917a782ceb139955af8cd814704b29c58e548c47c3e521b872fe8e62301d54301ec
-
SSDEEP
12288:KO3+ivi0RNOR/5DH2InMtdhtvX2tvJljUWcJxm/Osj3lx7l6X0k97L4HAF3itk:7vdvOZ9H2+Mt7tvX2tvJljT/mi1xJ6tX
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Loader 'dmod' strings 10 IoCs
Detects 'dmod' strings in Dridex loader.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\21980ef35dee23086acef389e6ce648d8ff396da56b7482b5bc8774120c74b6c.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\noGb77M\omadmclient.exeC:\Users\Admin\AppData\Local\noGb77M\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\YWU\BdeUISrv.exeC:\Users\Admin\AppData\Local\YWU\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\akPgsLK6b\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\akPgsLK6b\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
728KB
MD5068a77ab7ad4aa3a2369f3bd4691ef86
SHA1f53665584c12cdb45279d615c5a6b249588f2283
SHA2566d2524596ca3634b35b1de7218c6baf9c342736d01f7b4a4b28536f8e4d319e7
SHA5120b04ab0755b665ebe512f45c5c46ed27b84550e3165cdb3488b7835016a2035bb2981390cb4d1d4a5572fb8239b7832f62af69f19c704f149694127f25c4633e
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1004KB
MD58bab4efdc83f5b2ee1234cec8cd89675
SHA1c2fef93947bfd776dcc3d801a6e454d668be4b58
SHA25607d2fdd8c2ecc52e3242356e1b7f44728f5554a4255d97c8716e300e34976cdc
SHA512c5d99ee2462d016d8d1481740592f564734f9977a59383a4ef908e3f6099438f9a8474e3adc05ee4ce2bab271390c4020a51ac73a879ebe30701b737ceed3435
-
Filesize
728KB
MD5f9d526eb988abfbc2b0f732fb23d1fa8
SHA1c55dffebcd0c1d9c7d57522cce4ccba2d80f36cd
SHA2569b0da1fb469bde54c4de52a5d6c730fbbe14cc4a149deee51102b22cc98ab4b1
SHA5125bad224f7e2fdcff7806aa00418bd53f8ea7c029fef0be8616becaaa73b0fac445e73bfb531cae208f923866f7359cd70228b96525e64f35e0e6c1b7b9855c80
-
Filesize
425KB
MD58992b5b28a996eb83761dafb24959ab4
SHA1697ecb33b8ff5b0e73ef29ce471153b368b1b729
SHA256e0c6c1b082c5d61be95b7fad95155b7cb2e516d6dcd51b8e1554a176876699e7
SHA5124ab0d71f6f9e5a5d0870d8e6eaa4b5db74ea6148de0a00603e3e56303d0fec4722172e0207b9678a5bd0136f2d43d43b9d34907183369ab3b9b9c1484034fe3d
-
Filesize
1KB
MD506f015f8cfc9e057dcc3534b1f983495
SHA1a05865141d78ef745c3dc29ead162dde5a6886ca
SHA25657b5bda9e6e5da47e58221dfcda29604ed82885cc0fe6dab9174ef0b8c77c71c
SHA5123ed8dc45b99acb0a9eefddb7ef28e4286ea05607e3f5ace0920abfbb0183bd0ab6ab4cda22c2e9888146164237f66a61c605a006ebe0cb5983b87cc6293ce094
-
Filesize
1004KB
-
Filesize
1004KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
728KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
724KB
-
Filesize
728KB
-
Filesize
728KB
-
Filesize
28KB