Overview

overview

10

Static

static

3

200540aecb...f3.dll

windows7-x64

10

200540aecb...f3.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    11-01-2025 21:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll

  • Size

    612KB

  • MD5

    9283fe253dbbb2e725040dada2126ab4

  • SHA1

    26d5a954feaa4a772aa2c2c7845176359e7bc2b1

  • SHA256

    200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3

  • SHA512

    e4f236a4f1827e85f0923d6ec53c2b2a041db76cd548cdb9554c7d85bcc6681839d3548f5fa68e509c11705e5f9762f580e3f5dd89878ea8d8718581c2dd0b21

  • SSDEEP

    6144:mh7RxJSC3VZLCEixjAoN6StM3LORFxz0Mn0G6oanXCW5DVQGVDmrvcJdR7OsDtom:mh9fKxjNoYxTw9XrRK0dBOJpy0RXR8p

Score
10/10
dridexbotnetdiscoveryevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 38 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2448
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2472
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2964
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x494
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2168
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1660
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2496
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1976
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2144
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1752
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:964
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1720
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3020
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2248
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2076
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2504
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2500
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:1992
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:2440
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1616
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Modifies registry class
    PID:1512
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:1936
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
      PID:3032
    • C:\Windows\explorer.exe
      explorer.exe
      1⤵
        PID:2544
      • C:\Windows\explorer.exe
        explorer.exe
        1⤵
          PID:960
        • C:\Windows\explorer.exe
          explorer.exe
          1⤵
            PID:948
          • C:\Windows\explorer.exe
            explorer.exe
            1⤵
              PID:1552
            • C:\Windows\explorer.exe
              explorer.exe
              1⤵
                PID:1928
              • C:\Windows\explorer.exe
                explorer.exe
                1⤵
                  PID:2968
                • C:\Windows\explorer.exe
                  explorer.exe
                  1⤵
                    PID:640
                  • C:\Windows\explorer.exe
                    explorer.exe
                    1⤵
                      PID:2916
                    • C:\Windows\explorer.exe
                      explorer.exe
                      1⤵
                        PID:612
                      • C:\Windows\explorer.exe
                        explorer.exe
                        1⤵
                          PID:1900

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/2472-0-0x0000000000120000-0x0000000000126000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/2472-1-0x0000000074A10000-0x0000000074AA9000-memory.dmp

                          Filesize

                          612KB

                          Download

                        • memory/2472-4-0x0000000000120000-0x0000000000126000-memory.dmp

                          Filesize

                          24KB

                          Download

                        • memory/2472-3-0x0000000074A10000-0x0000000074AA9000-memory.dmp

                          Filesize

                          612KB

                          Download