Analysis
-
max time kernel
149s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
14-01-2025 07:48
General
-
Target
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll
-
Size
780KB
-
MD5
a182362bcd4f647cddb6970228afe715
-
SHA1
d197931c9255dfe7daba645d328656bc1e2dfa39
-
SHA256
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80
-
SHA512
c49efae658487b0d76eaefd119d585572b72f8cf789daa9b3e7070c461886d33df8120d389057f9ea278cb37964d878514e49711451be22cd218f7ecb846496c
-
SSDEEP
12288:rbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:rbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\KT4\slui.exeC:\Users\Admin\AppData\Local\KT4\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\bx4gOcKla\msra.exeC:\Users\Admin\AppData\Local\bx4gOcKla\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\3vnBg2\Netplwiz.exeC:\Users\Admin\AppData\Local\3vnBg2\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD5cc4ef609534e0ff076da79b4e154aeb6
SHA193959983fc2ac332a35922abd17bb34d99723d6b
SHA256410c5ebc343d853a0a6d2becaafa0a4d830a5e6598c1dc16a2eb406dacd31e65
SHA512569e603c600c90fa2abb0629512333f9d242748894990b0b92b3b220e73abf767140f410604a4edc74808bcf195b24dbfbfb02b1447cf76bd5ee77e804f5d91c
-
Filesize
780KB
MD57205601ecf57685763f49702491da6c7
SHA153d17a767a7e481f22da10fde47969077af6d6a4
SHA2564f55cb1117daf9586ea382ef3a38155d04a988b75d59bdbe5637567f818e9a71
SHA512fdc6e469ce1ba8c52353acbd5b9af7de260e9e2055d417de624715cb2dea1e893a12b8dfe05900df146913c07c549bf4d3dba2cadabc5924bab58c7ca01ef02a
-
Filesize
784KB
MD5ff324829b68ad7f17cbbac5d4d2161f7
SHA12e27e75d99cf7000da6efb76aab7079904a0cecd
SHA256f444dc4a4f1ae7af55e7da0c38ddd6db29d467a14d6482f865b4babafeadb9d5
SHA512ea7d1cbe64f8859ba7847bd5a9d6e0b1469f84c6b2a5b0dec249e012c730f3b8702cd2309e42ce3abd160d56982756cc4e0d785483965c95cb56e0f5fef3e143
-
Filesize
1KB
MD5f36ea6e6eb7d09274f64f853ffbce786
SHA18dd543970553081129829f86384e089a071e350a
SHA25686a76c3c81e7e52d62ad511210d6baf8dc558c8f39f604bfedde40c20b2573d1
SHA512d4cd1d1f2f2632ce2ce5b226d4cc03f726fa3f603baa1b2dc5d808e1be3e6a36e230a92863ada4395b0eaba2313ed631b8b2ef74da31c4dff78fe2b0a2c2df81
-
Filesize
26KB
MD5e43ec3c800d4c0716613392e81fba1d9
SHA137de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
780KB
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB