Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
13-01-2025 18:05
General
-
Target
fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843aN.dll
-
Size
804KB
-
MD5
0f413d5ba9a89182b758896df48db410
-
SHA1
7a1fbfde26fd73a4d27a71bd4300392c3b2dadf7
-
SHA256
fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843a
-
SHA512
1a083ad20a5def7fef52dba3327e968aa288105b1820c5639d80b488d38e50e0c0005f085233d70f22600e3cda8079e60db4f5b541f28636686505d47bf6126f
-
SSDEEP
12288:YbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQeB:Ybe42XV7KWgmjDR/T4a/Mdjmv
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\fe04562ba37a35c4d3c0f44c1e721f24078eaa70c8bd1ceb7c6ac6a6f1d2843aN.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RDVGHelper.exeC:\Windows\system32\RDVGHelper.exe1⤵
-
C:\Users\Admin\AppData\Local\8W8n7Ov\RDVGHelper.exeC:\Users\Admin\AppData\Local\8W8n7Ov\RDVGHelper.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\irftp.exeC:\Windows\system32\irftp.exe1⤵
-
C:\Users\Admin\AppData\Local\eqjSC2d\irftp.exeC:\Users\Admin\AppData\Local\eqjSC2d\irftp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\p2phost.exeC:\Windows\system32\p2phost.exe1⤵
-
C:\Users\Admin\AppData\Local\IPv4jYHr\p2phost.exeC:\Users\Admin\AppData\Local\IPv4jYHr\p2phost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804KB
MD58327a65f8506d061b99800351346d102
SHA1e2b3b143f2606f2757fbce88ebd3ca58a3701182
SHA256fb37875c458f3bd6ab30dbb956b48ecc514fba0bb471d4fe836c094167630bb3
SHA5120cc432b823efef0e486b2b94917acecfa3411f5820dfcbcdc704fd5e0936576508f99140371df6d7449be73f81d4b02f6c055d12b1d1b84828ada36cb4986062
-
Filesize
808KB
MD558035107741baf15632768e2c2551bf6
SHA1c44339fa78d87928fdd70d1bc87e139440511685
SHA25650881deb5d7a95ea037fd71f5b9124aad5a648f5c03049a6a0354709c76d6216
SHA512e5359c1ee06073ac06dfaa8411275fe6d5a271c7d951f805c319302d90815bc2039c3c1acc700f7635ed6e3f48ef59d908ecd2feb975e84fe4c98de6fec49b21
-
Filesize
832KB
MD505fe95d8e35e5ef4f63a2bbcc824357d
SHA1a48748a0c2aa4f17419e3f82c1fee7859f0ac707
SHA256f88e0665194a1ea13e6adb32e9346bef99adcffc9680cdc306d62eec2b9e9b47
SHA512a088070f54bea58e2a5a3a79f4e84c2ca6e08f6c111e47c380bd964494a9f85902194bf4a890d2ce9fe0411e0ed64cd195a00136c5a5f0887df900b394a59e26
-
Filesize
1KB
MD5818d4c029fe1cdc44fa3fde253614c4b
SHA1d4674395492dbebb2e9bf495482778e4b8fc7b16
SHA2564a75f39ee8097d721c8574eb5842d6ca9c673410c4f974a194e9a9b3c133e0e2
SHA512129faad869910cfcd40cb36aecea51af6748fd2e81bde0479229f01ff1404d924de1504d5a3d011a77cadff97ef1e5a7a6b745ef21a37cdbcb23ea6984f58a31
-
Filesize
93KB
MD553fda4af81e7c4895357a50e848b7cfe
SHA101fb2d0210f1c47aaf684e31a9fb78f89bba9c0f
SHA25662ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038
SHA512dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051
-
Filesize
172KB
MD50dbd420477352b278dfdc24f4672b79c
SHA1df446f25be33ac60371557717073249a64e04bb2
SHA2561baba169de6c8f3b3c33cea96314c67b709a171bdc8ea9c250a0d016db767345
SHA51284014b2dcc00f9fa1a337089ad4d4abcaa9e3155171978ec07bc155ddaebebfabb529d8de3578e564b3aae59545f52d71af173ebb50d2af252f219ac60b453d1
-
Filesize
192KB
MD50cae1fb725c56d260bfd6feba7ae9a75
SHA1102ac676a1de3ec3d56401f8efd518c31c8b0b80
SHA256312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d
SHA512db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
8KB
-
Filesize
804KB
-
Filesize
4KB
-
Filesize
804KB
-
Filesize
804KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
28KB
-
Filesize
832KB
-
Filesize
832KB
-
Filesize
804KB
-
Filesize
28KB