Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-01-2025 16:16
General
-
Target
dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1.dll
-
Size
716KB
-
MD5
1495a2d3a5052564d2318936861a0530
-
SHA1
df2db259ff86f00d6b52836e757565346cb77f48
-
SHA256
dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1
-
SHA512
5319b738bb4922b00e5ad97708c83ce0bc8166b04ed24c89d2f50c510f6e91777bc9c1e04e48ceed6363cfe52abf34dd31186099251da3899b18456b4d4a0d59
-
SSDEEP
12288:ROCRucgLs3bu9FRcOL5yEPAIiCj6ELV32KrXZiQJ8cXFpoTj:cCroYbu9FvAEPAIiy6ELV32KlFs
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\dac160c6d30f4ea4ee0bfa29faf72f93de7bf24340286ad025ab16fb007a17f1.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\hx7zV6\msdt.exeC:\Users\Admin\AppData\Local\hx7zV6\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\vmicsvc.exeC:\Windows\system32\vmicsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\rkI\vmicsvc.exeC:\Users\Admin\AppData\Local\rkI\vmicsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\jpAc8FYQ\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\jpAc8FYQ\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
720KB
MD5f7bdc13e3abff70c632a624b2e34129f
SHA144a938156e76baf8278ca5b9795768720924cbe4
SHA25686cb85102d4b293c055e5cddc2fbd22c11b6b29f9f733cab51862c6bec52fbf8
SHA512bd76897a26aca8931cc3ec5e0cd84ceee49b850a3ca4f567eb01f1c03248dfd0f729801a50337c3e765b54655b94eff87a1e2305a38f36f71ad2bf5120a8cae8
-
Filesize
720KB
MD5af3372e20193d2ba95bc5d2f8caf8252
SHA135f9dc6010dad14809cba9de8a160d8df96107d2
SHA256317e1a6a4f3b72264da0680180b3ea8286c757f31f51b47a152ba772b178f753
SHA5125f00698637d1eaccceea9604412698e938b46660989a4666e001de19c7325d11431a6337df197625cf6493a85d8168be67ca72a5a17dbb8ce5790954049338c8
-
Filesize
720KB
MD54157c56a1ec2f2c19707bd05286f574e
SHA118226f71192e4706fe7641ed91b7d8ff6333929f
SHA2561125e0465edc6793a9f6935a13a5a5e80c3d554766c213b90101de781e05b351
SHA512bd7c3e9ccdcc2d88ced8ccf913d6ed6349afe7867a01829bc7087a4c36173c8e6bc861b071fb7368be912f31fbfa03ca222d673cb9b5e6cb14f58380f40eac9e
-
Filesize
1KB
MD51ee9c84705f86319327a504606dc5263
SHA19b2b2cd1f664431f16a2189def2c220c6a3c274f
SHA2562a5b5f34f9635cb56d655ab52e68f341622dd4ec0cd0020130a16fbff0a2cbe0
SHA512b273a2960b42e9a0dcf4aa43461efcb8aece1552c782d1c663d22c673f0dfa30528da39d402c6642b9e17d0ed2ce150132cfb91a1307c3876ec1b2527e670810
-
Filesize
1.0MB
MD5aecb7b09566b1f83f61d5a4b44ae9c7e
SHA13a4a2338c6b5ac833dc87497e04fe89c5481e289
SHA256fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5
SHA5126e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
238KB
MD579e14b291ca96a02f1eb22bd721deccd
SHA14c8dbff611acd8a92cd2280239f78bebd2a9947e
SHA256d829166db30923406a025bf33d6a0997be0a3df950114d1f34547a9525b749e8
SHA512f3d1fa7732b6b027bbaf22530331d27ede85f92c9fd64f940139fd262bd7468211a8a54c835d3934b1974b3d8ecddefa79ea77901b9ef49ab36069963693f988
-
Filesize
720KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
Filesize
720KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
4KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
28KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
720KB
-
Filesize
1.7MB
-
Filesize
720KB
-
Filesize
1.7MB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
28KB