Overview

overview

10

Static

static

3

200540aecb...f3.dll

windows7-x64

10

200540aecb...f3.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11-01-2025 21:06

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll

  • Size

    612KB

  • MD5

    9283fe253dbbb2e725040dada2126ab4

  • SHA1

    26d5a954feaa4a772aa2c2c7845176359e7bc2b1

  • SHA256

    200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3

  • SHA512

    e4f236a4f1827e85f0923d6ec53c2b2a041db76cd548cdb9554c7d85bcc6681839d3548f5fa68e509c11705e5f9762f580e3f5dd89878ea8d8718581c2dd0b21

  • SSDEEP

    6144:mh7RxJSC3VZLCEixjAoN6StM3LORFxz0Mn0G6oanXCW5DVQGVDmrvcJdR7OsDtom:mh9fKxjNoYxTw9XrRK0dBOJpy0RXR8p

Score
10/10
dridexbotnetdiscoveryevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\200540aecb9b1f65ed9b69f28236a68ab6ba148efba290abb76c89b133d93bf3.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3356
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3952
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4064
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:392
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4452
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4464
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4484
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4132
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:1880
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:3960
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2240
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:4648
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4584
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3896
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:2268
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
      PID:4104

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
      Filesize

      471B

      MD5

      2f247b5ed87bb5c2f0c79a7d9b2ecf7d

      SHA1

      53713a9fe64f0d68a35a77180e7b949444efb793

      SHA256

      1f83e56eca45b202a86f8e33feeaa8f41db3b5d6eb2ba5df32e82d5499a5bbbe

      SHA512

      3eeff39a11829e3f77127c73f5d3ac0e1735ce3b51a830e829da140aa7cbb1dd909b018de82644935be5658b1cb55a82b232bb128a4011df5de0f86bcd97c7c5

      Download Submit

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
      Filesize

      412B

      MD5

      4cc5bba332956a3af51125b0d4a01e38

      SHA1

      0639198ea3ff06aabafee9687543902071c3e130

      SHA256

      e9d03707b69cee60aecad48970ec29b21992d108f02a44a5b07bd36d4b845153

      SHA512

      4333abb3e40706fac7536c63e90cfd3ef5b1936e340446d7e3966e525ee95042048590c8e7b10cfe636ca4c0686399dc7ac7143fe13d3c4b7c303cbdd14366be

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
      Filesize

      2KB

      MD5

      984e675ae50a3510d110e2305bdb6d94

      SHA1

      66d8549b4e4d8c7d5d15d787b43d8fa7ea5c0b0f

      SHA256

      4c47a0238ee1c2cb948199819dbfce1ef77826e08781e9f989df7ab765fac352

      SHA512

      6e4e5407e3e859c36a5df223935167c6603c6b67091583b552c80c10642c8bffab2492fece64785ce2b8fb6427bd5cdf877746a04f41e24a9d5d15bb95b5c75b

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
      Filesize

      36KB

      MD5

      8aaad0f4eb7d3c65f81c6e6b496ba889

      SHA1

      231237a501b9433c292991e4ec200b25c1589050

      SHA256

      813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

      SHA512

      1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
      Filesize

      36KB

      MD5

      ab0262f72142aab53d5402e6d0cb5d24

      SHA1

      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

      SHA256

      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

      SHA512

      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YOZOSN6K\microsoft.windows[1].xml
      Filesize

      97B

      MD5

      e6ba99d8293b4c7951bad0a2c6761b8e

      SHA1

      87aaf2d975cdef4db219e4f9f2b1469dd05a6b0b

      SHA256

      773b2b8b752a5bfd3d93b7475dbb7f659bad014ffd06292ee0450c216892ac29

      SHA512

      e6861e87688861f4c43d80f9e98996fc476a11d4e147eb3c55f66d6f1abc065690e2662dd34dca32c0284b64056b95142d932697aa1fa6d6b755ef0f57031ee0

      Download Submit

    • memory/1880-20-0x000001E767660000-0x000001E767680000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1880-32-0x000001E767620000-0x000001E767640000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1880-51-0x000001E767A30000-0x000001E767A50000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3356-10-0x0000000074ED0000-0x0000000074F69000-memory.dmp

      Filesize

      612KB

      Download

    • memory/3356-11-0x0000000000B90000-0x0000000000B96000-memory.dmp

      Filesize

      24KB

      Download

    • memory/3356-0-0x0000000000B90000-0x0000000000B96000-memory.dmp

      Filesize

      24KB

      Download

    • memory/3356-2-0x0000000074ED0000-0x0000000074F69000-memory.dmp

      Filesize

      612KB

      Download

    • memory/3896-173-0x0000025D4D120000-0x0000025D4D140000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3896-195-0x0000025D4D4F0000-0x0000025D4D510000-memory.dmp

      Filesize

      128KB

      Download

    • memory/3896-168-0x0000025D4C000000-0x0000025D4C100000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3896-183-0x0000025D4CDE0000-0x0000025D4CE00000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4484-13-0x00000000029D0000-0x00000000029D1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/4648-166-0x0000000003810000-0x0000000003811000-memory.dmp

      Filesize

      4KB

      Download