Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-01-2025 16:10
General
-
Target
dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1.dll
-
Size
716KB
-
MD5
1495a2d3a5052564d2318936861a0530
-
SHA1
df2db259ff86f00d6b52836e757565346cb77f48
-
SHA256
dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1
-
SHA512
5319b738bb4922b00e5ad97708c83ce0bc8166b04ed24c89d2f50c510f6e91777bc9c1e04e48ceed6363cfe52abf34dd31186099251da3899b18456b4d4a0d59
-
SSDEEP
12288:ROCRucgLs3bu9FRcOL5yEPAIiCj6ELV32KrXZiQJ8cXFpoTj:cCroYbu9FvAEPAIiy6ELV32KlFs
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\YPnT\BdeUISrv.exeC:\Users\Admin\AppData\Local\YPnT\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\eudcedit.exeC:\Windows\system32\eudcedit.exe1⤵
-
C:\Users\Admin\AppData\Local\YXAUCVXL\eudcedit.exeC:\Users\Admin\AppData\Local\YXAUCVXL\eudcedit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dwm.exeC:\Windows\system32\dwm.exe1⤵
-
C:\Users\Admin\AppData\Local\jKlG\dwm.exeC:\Users\Admin\AppData\Local\jKlG\dwm.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD5f5e138d005dcdb27d5b920b69c98682d
SHA1fe2d647e61a9a8ca68b0107446d896e340caae68
SHA2564bfe445c17f4acf532c62dd67707ad0adf5e13ba220b4142b35191afbbf90fcf
SHA51243bcd0733cbae1ce13fc67e79692478f8125e29310a3a34fe6ad0e481ce87d2d31bce3a52c88e8c634af22e19861f322ed4114ae420e0416e64c22bdf7c11318
-
Filesize
744KB
MD56fa9b9831ffbf45192f9e983ab6a6c06
SHA182bd618abac2bbd4fbac2739bcf559e47105b316
SHA2563893678ce09939980d92d318697f040a2fb25cacc500f125fd3f3f6477747a8b
SHA512bf21d2b92b42f15f4ca45a01c1d117ea929839465860b5437ad83bbe73c443365455cbc6ec6ddb523781d25b66c22ff9240a1df126716c20c890bc93a71ff2e9
-
Filesize
720KB
MD56df8009b9e469aef7b0778578fac1226
SHA17ae987a601ab6f3b741a5e836dff58a374c6e793
SHA2561986d1caab723954f090f2fec35f3925929e1b5fed2a5ed209c94e607fdbd138
SHA51255786e539e31f70c00d66149f5a9267c1cc6fa278d5b8cc3b6ef8652f8d67fc1851f1f2a469fac317bf72ee2928c7de385f69fc76485481536633328801665ad
-
Filesize
117KB
MD5f162d5f5e845b9dc352dd1bad8cef1bc
SHA135bc294b7e1f062ef5cb5fa1bd3fc942a3e37ae2
SHA2568a7b7528db30ab123b060d8e41954d95913c07bb40cdae32e97f9edb0baf79c7
SHA5127077e800453a4564a24af022636a2f6547bdae2c9c6f4ed080d0c98415ecc4fbf538109cbebd456e321b9b74a00613d647b63998e31925fbd841fc9d4613e851
-
Filesize
1010B
MD52e06cfccd463caf8812b358325d2fc68
SHA1d330a2aedbe375e37876caab823c79221faeb7c5
SHA256a7f19e07ca99d53bb51b981d3ca955cd22cb903d5575062787ad538ca761bf96
SHA51238eac4249ab28a748b96a8ca4b4156230451d2186a93b5f25728c9c3b5d72e6971a65d9264497a5e7bbc40b90e8f76ba94442797d17eb2b2400f048ddc36bc76
-
Filesize
47KB
MD51da6b19be5d4949c868a264bc5e74206
SHA1d5ee86ba03a03ef8c93d93accafe40461084c839
SHA25600330a0e0eb1dbb6ee84997963f8e15c7c15c1df787f1c7f109609d7b31bd35c
SHA5129cee858c55eb0852e5bad53a675a094ae591b46b07afe9fb4224cac32e0be577fe36c1ed3e9f6bda4d4eb0c924a773d00e3181cd97f07e24c6c68c70f2b002c6
-
Filesize
351KB
MD535e397d6ca8407b86d8a7972f0c90711
SHA16b39830003906ef82442522d22b80460c03f6082
SHA2561f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde
SHA51271b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e
-
Filesize
744KB
-
Filesize
1.7MB
-
Filesize
744KB
-
Filesize
1.7MB
-
Filesize
720KB
-
Filesize
716KB
-
Filesize
28KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
28KB
-
Filesize
720KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
720KB