Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-01-2025 09:48
General
-
Target
15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5fN.dll
-
Size
776KB
-
MD5
2ea02df4d1bd56b7862da01c65d23ff0
-
SHA1
a5152f9cc2dc61cc043b4c2e339c21772bd59b7e
-
SHA256
15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5f
-
SHA512
ce84da187fdb2b9cda9ebeddbd316d84eddac42c7ee51f2a3b77bc3f447da1a5e27f14f94b29043826def088e32560510cc6db4342a78aaf8df8ee38101aa534
-
SSDEEP
12288:oGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:53JAvRl/fKQKCgFfx4P/va
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5fN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\DU0\perfmon.exeC:\Users\Admin\AppData\Local\DU0\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\fPA4w\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\fPA4w\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\kxA\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\kxA\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD5be4011134fe39d4c7f96275f1f8ffcf4
SHA13e596eaa804cadce21a98aaf26f114792e38a2c7
SHA25609cf73c9c97249bcdbd3c79f40ab77c13321c7582a96a7568fa5dc573e65610d
SHA5128a8411f7ea743720b42363d0ed177b151c284f1568b0714e72e242d30797b58ec58cad42407becd432fafd62228b86fe1853ddc1a94357b3332d49f31e66d7f4
-
Filesize
780KB
MD58f46d23a798e99f1edbc8265c284d580
SHA1402e898ad5790fd2e845e885e5bffeb70e947904
SHA256b8c44c053afe232cc41fd70797bb1abc6bfd287dad57c68dd090892929931364
SHA512d09db0e39bd644e6822cd06e36cf02924c3e77aa657c0d47b1b92a39aad1cae0c04b024836ca2aec08ba21ab58f0bbb53b3699e6c4a74352a68245bfc3e7de4d
-
Filesize
984KB
MD51ec06f9efba0509f1b4b01f9b8fe5604
SHA1b032b10415eea03f1111a3b0b8063101b1709de9
SHA25658cebe167400f2a3a6e99c484330337e9953962561854f4f1b34aebd07f2459e
SHA51205ca0f5b1f585248a09ed4b4e0328e849df6c176bc93ae2986427930a154b963a06f2c9589702d6abc67c7f85eb5385ea5030fd69c4da82ebf4b8d0ebb4b6743
-
Filesize
1KB
MD50bd4d4dfa6f5d0bfc3f05bb89b129a7d
SHA171c595b919d8cf21f3f73127d969d27ec26f00a2
SHA256e213783f13be6f2a265ae9d8873f8a7af7aa86145714aab58521ac31bbeb8b60
SHA512f709ae9670849d2a3fa75d111271e41df1edceb0c931e9e7dad9afb2b82f9e93fc26c40dd7706de5840b943697b452d3e14dde21b26eeed4efbe60cd7e9454ff
-
Filesize
168KB
MD53eb98cff1c242167df5fdbc6441ce3c5
SHA1730b27a1c92e8df1e60db5a6fc69ea1b24f68a69
SHA2566d8d5a244bb5a23c95653853fec3d04d2bdd2df5cff8cffb9848bddeb6adb081
SHA512f42be2a52d97fd1db2ed5a1a1a81a186a0aab41204980a103df33a4190632ba03f3cbb88fcea8da7ed9a5e15f60732d49a924b025fe6d3e623195ec1d37dfb35
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB