Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 07:48
General
-
Target
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll
-
Size
780KB
-
MD5
a182362bcd4f647cddb6970228afe715
-
SHA1
d197931c9255dfe7daba645d328656bc1e2dfa39
-
SHA256
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80
-
SHA512
c49efae658487b0d76eaefd119d585572b72f8cf789daa9b3e7070c461886d33df8120d389057f9ea278cb37964d878514e49711451be22cd218f7ecb846496c
-
SSDEEP
12288:rbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:rbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\uvV\systemreset.exeC:\Users\Admin\AppData\Local\uvV\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DmNotificationBroker.exeC:\Windows\system32\DmNotificationBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\z8b5ALD\DmNotificationBroker.exeC:\Users\Admin\AppData\Local\z8b5ALD\DmNotificationBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\4Bd0vLh\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\4Bd0vLh\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD5d0b4d885840c3a28629258c9cc6f667a
SHA1db8cf33da8606492e3602ec5148f744f848e32c3
SHA2564d61c6633fa7d0ca9bd5dbb4597b6f4a987bd9d5f22086ef3254b16bceec680c
SHA51202b9e8c904f9fe7b3a33c0aaf1254de9e0db4100921cb0458d6ef063267251d1fe2e8110436a15cf6e0679e2bffd000ac6f5650e7de625e32c9df970ab66c913
-
Filesize
82KB
MD5bf5bc0d70a936890d38d2510ee07a2cd
SHA169d5971fd264d8128f5633db9003afef5fad8f10
SHA256c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7
SHA5120e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51
-
Filesize
1.0MB
MD5b6e51ff018ccbda32c07eb59722725dd
SHA132f6f01f3ae54964b9d939bb45ece73245052280
SHA256e182954591a10dadcae93bdaab9ba33fc30590c370ef1a458f0745c138222aea
SHA5120bf79b56705d697f13ba02fe0214903120547e97535572d9ac5975dfbf5fe5149e4797aa21e296b28bb1521f75b57c7d3dc9529666c6467d94a0f471e0b0599a
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
1.0MB
MD53e62bd3a5d4bd9482b6ce4fe342b39a0
SHA1bd0adaf28839273ddad4d4607bcdac73179056fb
SHA256187f2f2147faf17bcef6c1e672aa0ff73e008bc4a5b219b47850260c224069a5
SHA51238637bdf9752617c32530dd850f4673c1064bbc8b0ded1fd719a58a8bc06f2afbc71e1607ca52f522ad22581318ccda2d1449b12ecc46bdbd03e25e77c10c744
-
Filesize
32KB
MD5f0bdc20540d314a2aad951c7e2c88420
SHA14ab344595a4a81ab5f31ed96d72f217b4cee790b
SHA256f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5
SHA512cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa
-
Filesize
1KB
MD5ef514f1e6214ec73cd41ecf54b080d1a
SHA17698a73029d77e43e594856e6900e66f0d56ffcb
SHA256b8537af9b958a302de23f263b5efc08e2f0ffcab44e4be853a4621f44fd0bece
SHA512a68e503f74e4ecd186c41d5b4150f1603483c060554c0299039e75441deaa1b5e5726585b4d516455f5e9a233db682bb968f90b2357db7e550ebddbb07db3987
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB