Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 01:30
General
-
Target
5a157047eafbf851e6fe87a68dfb489bf4bac615c2698797b5129fe3a8a6a996.dll
-
Size
780KB
-
MD5
8fa9b4c27bd3e4304a59e5e72d68cd9c
-
SHA1
c20c63a23dcda13bea5c22fbee61015cc55018d1
-
SHA256
5a157047eafbf851e6fe87a68dfb489bf4bac615c2698797b5129fe3a8a6a996
-
SHA512
b0ef9910306ed36e8ab3b9db673b503c7e4ee4fe33fa0bed57619a6cc8496e56200451e1d7ec5d7980db9b810bb8fa15b0296c5d757750322b22b240ff1c7e80
-
SSDEEP
12288:nbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:nbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5a157047eafbf851e6fe87a68dfb489bf4bac615c2698797b5129fe3a8a6a996.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Users\Admin\AppData\Local\MUtr3\RecoveryDrive.exeC:\Users\Admin\AppData\Local\MUtr3\RecoveryDrive.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\ASSPuGph\Taskmgr.exeC:\Users\Admin\AppData\Local\ASSPuGph\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DisplaySwitch.exeC:\Windows\system32\DisplaySwitch.exe1⤵
-
C:\Users\Admin\AppData\Local\UxXCMFN\DisplaySwitch.exeC:\Users\Admin\AppData\Local\UxXCMFN\DisplaySwitch.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD56bc1f2bca6fc9709a6a9d2541c7b6adb
SHA1edfca1479e53ace769171ba6a791c6d810d701ca
SHA256d29cbd3215a7a47afd467799df2e6d7c36765821ba10635c071c8a05af2b8b4e
SHA512568b662c7420fdbd291a3b4d96195cdad9f3bf3dd3b0760a1e52c4d93fd3d7961795bb9fcddb637f47e13ed49a9fe33b120f6b3a4490dbb11e0cc2b9db9d8e8c
-
Filesize
1.2MB
MD558d5bc7895f7f32ee308e34f06f25dd5
SHA17a7f5e991ddeaf73e15a0fdcb5c999c0248a2fa4
SHA2564e305198f15bafd5728b5fb8e7ff48d9f312399c744ecfea0ecac79d93c5e478
SHA512872c84c92b0e4050ae4a4137330ec3cda30008fd15d6413bf7a913c03a021ad41b6131e5a7356b374ced98d37ae207147ebefd93893560dc15c3e9875f93f7a9
-
Filesize
784KB
MD554bf8961cb7f469f418b4f650bfa039f
SHA16bc3529a54a7462fc42878e767c291c6602e4631
SHA2562b7b84d2ba1ab4a87e8427cae6564388b2176690f98ea2d31f777925dfd2bb32
SHA512f7df6927a79ff45348c131efbccf5d19d71da767fbed87d5cfcf4dd716d472ebd69d08dcc987145c4b879089dfe8ebc3c85fdeadcd3a4fc56b4ed5fe7c6be40d
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
1.8MB
MD55338d4beddf23db817eb5c37500b5735
SHA11b5c56f00b53fca3205ff24770203af46cbc7c54
SHA2568b581f1d15a6920e4ecfe172d8ef753d0a2bf1a47e686a8d5d8e01147fa4c65e
SHA512173170b83e0048ee05da18c0c957744204954da58a93c532b669d62edb632c4c73d0744c13eb864ecf357ff12831aa46c4f2445dc33b62a4547385b9e0297b0c
-
Filesize
788KB
MD5c7c01ecc274e2655505172b2784021da
SHA183c52e1ffbef6b1200be534b1368a67eedd7766e
SHA256db5bc1e322b03519c6697480275123966f4bc173dee073836fb6957f926e2919
SHA512ad5fa73db289fa0e7c1669d7738a7e3272e77f073182d0f765b688de89c6acb752bf00552ca7e1d5dd359d123825851131511d09c8b9dc4d536d5ddcd5127def
-
Filesize
1KB
MD52babb085cd6198aa954975405ad028c7
SHA1c4bff706a22bff8528a579fe5414c21f1c2915f3
SHA2569fadda52c4bbb63214496987a48fd5a0b567bcc16db2b63b149fb9bbc7600eb6
SHA5120597563e875829402fdde0212b90c25f23766f8e4cb5a9fd205b1384decbe82b0380e3e52612ce2d718aaeede3ca91b68484918bf33b3e6f6543ab50d7b6bef0
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
28KB