Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
12-01-2025 17:33
General
-
Target
12ea5105223f47e666b8ada79a01b005d6f9e8a2e2473f4806122462e2f8e4d0N.dll
-
Size
800KB
-
MD5
5dbc2a1522bc37b5103a1cbcd8fb0520
-
SHA1
ca646063f9e2cc6ca352f0bb81d67d9aef78a02f
-
SHA256
12ea5105223f47e666b8ada79a01b005d6f9e8a2e2473f4806122462e2f8e4d0
-
SHA512
51768b4c6a6396ba6282bb3d5f3347440e884a1f258d40f2567b09564b429c676e211f8f610961c5eda27b0fb7e64c29ad0a888c9cd75df584d22c60cc3a5033
-
SSDEEP
12288:wGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7wEN:h3JAvRl/fKQKCgFfx4P/vaw
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\12ea5105223f47e666b8ada79a01b005d6f9e8a2e2473f4806122462e2f8e4d0N.dll1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\ZlzMJ7\iexpress.exeC:\Users\Admin\AppData\Local\ZlzMJ7\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\RVb1nReK\dccw.exeC:\Users\Admin\AppData\Local\RVb1nReK\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\5fiHH1z\mmc.exeC:\Users\Admin\AppData\Local\5fiHH1z\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
808KB
MD5974e7864f6f48174ac85c613b2d060cf
SHA13d007cccfe5a0e40985dcbd4b14734ae2bd827e6
SHA2565eeb7a5fa2ad80cf8bb026fcab94649d0995765d5dbcfb1abd76a32dd2f2b135
SHA5124f564df2d38028d71eccfab52d790f65f8e4ecc9eee62add1c467f87350bc9ffdd0cb3e129226ab0115c544db78878c55aa2cebd49f6cc03a6314b0b15ff02cf
-
Filesize
804KB
MD52bfb1ea253c714ef8fdd544c9e27f3fc
SHA1894a51d5f44fbb3de5dd28ac0df342285c86d19e
SHA2568f91f5aa44aa132f0287b92c9f65d7daeb3f9dada21b08f44cc0bad260329cc1
SHA5129eaf92e0f87436a9a3b0ed361a08caaceac7ab79600e70659f1721d35c8e1c431d1abcdba10b93e6df80c346f1e1082ce9094af59ca5146a8c1b7900aec96d68
-
Filesize
804KB
MD5a19b8ae3f899f6b5ba3288cf43c0a204
SHA1d35c7751b62eb447294f1716ec865fe759fbfb19
SHA256860d2967ce71d5149466b164404f395be204c569ffca2ad7bd9aba57134c3513
SHA51299ecb23d65f6dbfceed973fedaaf0c49c3cf35398c5e3fe16c14d73b15c8be17099bf6c09e4e9e59909c22c5e934923eeff3e57d647b3abd2f3a6f3482d2223e
-
Filesize
1KB
MD58ab4210993a2d5da01ee22b086af719f
SHA1cd87e9f991ee5b5c4aee3710d38a798d23ed8cd4
SHA2565640bcc0b8eca182abb03fce6d021876ccf82172b47290583d8c50c289ef5535
SHA512bc40239e5ffd3a32c95b9cedf5776fa8b3e7574eaf9e4aa3937a9ce38ad0878b5ebbfabd22ceb9523d20f795cd923ae41be10f9a69d21d138f740a4327ac6154
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
28KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
4KB
-
Filesize
800KB
-
Filesize
28KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
28KB