Analysis
-
max time kernel
119s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13-01-2025 09:48
General
-
Target
15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5fN.dll
-
Size
776KB
-
MD5
2ea02df4d1bd56b7862da01c65d23ff0
-
SHA1
a5152f9cc2dc61cc043b4c2e339c21772bd59b7e
-
SHA256
15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5f
-
SHA512
ce84da187fdb2b9cda9ebeddbd316d84eddac42c7ee51f2a3b77bc3f447da1a5e27f14f94b29043826def088e32560510cc6db4342a78aaf8df8ee38101aa534
-
SSDEEP
12288:oGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:53JAvRl/fKQKCgFfx4P/va
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\15a87a272e27421376d40db82b49f9b9fa6b3cd3843f74273db6b12344b95d5fN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\EDW\raserver.exeC:\Users\Admin\AppData\Local\EDW\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\wlrmdr.exeC:\Windows\system32\wlrmdr.exe1⤵
-
C:\Users\Admin\AppData\Local\viUoR\wlrmdr.exeC:\Users\Admin\AppData\Local\viUoR\wlrmdr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\InfDefaultInstall.exeC:\Windows\system32\InfDefaultInstall.exe1⤵
-
C:\Users\Admin\AppData\Local\3GyO9pg\InfDefaultInstall.exeC:\Users\Admin\AppData\Local\3GyO9pg\InfDefaultInstall.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13KB
MD5ee18876c1e5de583de7547075975120e
SHA1f7fcb3d77da74deee25de9296a7c7335916504e3
SHA256e59127b5fe82714956c7a1f10392a8673086a8e1f609e059935c7da1fa015a5d
SHA51208bc4d28b8f528582c58175a74871dd33ac97955c3709c991779fc34b5ba4b2ba6ff40476d9f59345b61b0153fd932b0ea539431a67ff5012cb2ac8ab392f73c
-
Filesize
780KB
MD53015bf3a781615a6991a3028ddcd1938
SHA13f90a2d15e5dac9db8a38fecfe44b26793537890
SHA256d34bc0271a4c318394376f4f58c4ee9d6d545a9a0bca38c8c975ddd54b33d551
SHA51202eae7a9a829f3e25ed0f607c6e54baa96b7ae752651aec093b9f4394d19c332abc6fa13f5ca0869a58316f28ae38b78278283dec29f49b76bf6ad41a408619f
-
Filesize
780KB
MD562c12e56a9134c169b5a4e0609ff25d4
SHA1e74d684dd8d86bce2a735990a9c5ad46e26fb500
SHA256896fbdf2758dc617063279ac440a4f0ec85fb49e3fed2ddd51d28f5488966c07
SHA5129fd74b62618314611e3e3aef0d8b8044f192ec892225bb53b1b23a9dc47d4e487243d7fc0b807837663209404fa8cb5d0384716f4b25c9739f031f00f5024ee1
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
1.0MB
MD5aacf4e5f59562cb7316fe88b12608f13
SHA140c3bfdee9b32b96d5d73e0c2a40ff789d3e8bb3
SHA256331e56b14eefd156e9e39f629515c833ff5df260061f40376b3634924dc51e44
SHA512e1f805d5515edd3c06356d3e77e3e5fde5124728b0d62aa165153df2fcee4493b9b31396469c475fcb99b14a73748406fa5ae92281cf326b3ab5ff6d02551519
-
Filesize
66KB
MD5ef9bba7a637a11b224a90bf90a8943ac
SHA14747ec6efd2d41e049159249c2d888189bb33d1d
SHA2562fda95aafb2e9284c730bf912b93f60a75b151941adc14445ed1e056140325b1
SHA5124c1fdb8e4bf25546a2a33c95268593746f5ae2666ce36c6d9ba5833357f13720c4722231224e82308af8c156485a2c86ffd97e3093717a28d1300d3787ef1831
-
Filesize
1KB
MD55d8a17d57adbc4aeceb3f4f72f78e032
SHA16e6b78115888a755b1f96bc31457d79b753156d3
SHA25617770b554f4a5f4ca6720ea07b453705a9ce8cf9e114e1304aeb5bc751503dcd
SHA512aa148021c7062c687c41561cec697b631323efd57c16607610723bcca65f7892bee68c68c29672303837458e9b4d5b544fd22a9a7a94444751e0bbb00d93480f
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB