Overview

overview

10

Static

static

3

ff5b6160a8...f9.dll

windows7-x64

10

ff5b6160a8...f9.dll

windows10-2004-x64

10

Analysis

  • max time kernel
    110s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12-01-2025 02:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff5b6160a897fd01392782ff5f3d1e09ab7d1925800196913073e556ca7e4ef9.dll

  • Size

    636KB

  • MD5

    2819017203728ab41d8f11d0a6feb417

  • SHA1

    6755281aef289eb119dbcbe2132b66ef9f04f03f

  • SHA256

    ff5b6160a897fd01392782ff5f3d1e09ab7d1925800196913073e556ca7e4ef9

  • SHA512

    4399706ce3f26ad718e560257465db3f5d993b190bc6e6efbbffdea0aea040897270d968509319912e93a4f0307860e7471c80dc57a9e1ec77dc6fb3956ea2e6

  • SSDEEP

    12288:VTYHVq1aJ1Px+RT4PSBhPfixLo9lcG7VDqMt8:VU1q8MtFjl179Rt8

Score
10/10
dridexbotnetdiscoveryevasionloaderpersistencetrojan

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex
  • Dridex family
    dridex
  • Dridex Loader 'dmod' strings 2 IoCs

    Detects 'dmod' strings in Dridex loader.

    botnetloader
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Enumerates connected drives 3 TTPs 8 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5b6160a897fd01392782ff5f3d1e09ab7d1925800196913073e556ca7e4ef9.dll,#1
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:748
    • C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff5b6160a897fd01392782ff5f3d1e09ab7d1925800196913073e556ca7e4ef9.dll,#1
      2⤵
      • Checks whether UAC is enabled
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1724
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5092
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:760
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2844
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:2832
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4060
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:3988
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3588
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    • Enumerates connected drives
    • Checks SCSI registry key(s)
    • Modifies registry class
    • Suspicious use of SendNotifyMessage
    PID:2348
  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:4272
  • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
    "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3468
  • C:\Windows\explorer.exe
    explorer.exe
    1⤵
    • Boot or Logon Autostart Execution: Active Setup
    PID:1616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    471B

    MD5

    2f9015314ce4f6cf0f35dbb90517b878

    SHA1

    f35798a720e1d183fa4397fc19a276c599ac4aca

    SHA256

    460f7c233878f3c0a9115f70f5394c5b43d2937d3ac7349b43009d343ed6051b

    SHA512

    3f2459ca942460d578cfe9d1f92b01cf949bb26240b5fa4739e8e86768d8c74d362bf97916470b017a6684cb2b2386d9fb2c68c81dcb091ad332ce678bb3a00f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04
    Filesize

    412B

    MD5

    c2b77d1d154e98c8713086be89fe8c7b

    SHA1

    80927a62b4d1d5232b55ab4618c4bee88a74456c

    SHA256

    f8e31dde520b433801042937d2f17a877ba22d2987d936c302e39fb30cd0eb19

    SHA512

    00b48848d59648648f3d64e4f9edb6c0eef010e3a56a1157e1fb8c0d01a0b7f3e2a2ed677d1a590c2364d6ae0bb0332f1bfc5ce6cc8c0690793db737649b7356

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres
    Filesize

    2KB

    MD5

    3ef64d318b57b05cbf72c26b82a04a9e

    SHA1

    a2c7615ac44bf4925d769ff918e2c314dc794927

    SHA256

    fe257216568b11974ab8177cd496e841280ca6749f0329b99bcbdfb42568fcf9

    SHA512

    f5e0009d30a2b9b661d0fb399a8f60218967740f787b2207bc0b23471f5cf2aa5fc5f96847bc70a2548cb532c6c3644c7eaff727178151f78e839ce7f89e5dfb

    Download Submit

  • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\LLDJA3WI\microsoft.windows[1].xml
    Filesize

    97B

    MD5

    372706547a804b876522fe741dbfc040

    SHA1

    9bca733d6804f24c6841ef02b52e8ade1b45d7e4

    SHA256

    09fe1eb66c953d75dc66ff6df9237cde5f419fb25fab6327de9cde6676219651

    SHA512

    cc8057de048bf5646e41bed6f01111328bceae9abb4282a4ee1be635d086b6b3647cb5cc17cc3564980e5e31342a767dc639e536edbd3720df6b35ac7ebce34a

    Download Submit

  • memory/1724-1-0x00000000753A0000-0x000000007543F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1724-11-0x0000000001300000-0x0000000001306000-memory.dmp

    Filesize

    24KB

    Download

  • memory/1724-10-0x00000000753A0000-0x000000007543F000-memory.dmp

    Filesize

    636KB

    Download

  • memory/1724-0-0x0000000001300000-0x0000000001306000-memory.dmp

    Filesize

    24KB

    Download

  • memory/2348-164-0x0000000004080000-0x0000000004081000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3468-166-0x0000020C11700000-0x0000020C11800000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/3468-171-0x0000020C129D0000-0x0000020C129F0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3468-189-0x0000020C12DA0000-0x0000020C12DC0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3468-179-0x0000020C12990000-0x0000020C129B0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3588-32-0x0000029B9DB70000-0x0000029B9DB90000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3588-51-0x0000029B9DF80000-0x0000029B9DFA0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3588-20-0x0000029B9DBB0000-0x0000029B9DBD0000-memory.dmp

    Filesize

    128KB

    Download

  • memory/3588-15-0x0000029B9CB90000-0x0000029B9CC90000-memory.dmp

    Filesize

    1024KB

    Download

  • memory/4060-14-0x0000000003020000-0x0000000003021000-memory.dmp

    Filesize

    4KB

    Download