Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
14-01-2025 07:52
General
-
Target
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll
-
Size
780KB
-
MD5
a182362bcd4f647cddb6970228afe715
-
SHA1
d197931c9255dfe7daba645d328656bc1e2dfa39
-
SHA256
bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80
-
SHA512
c49efae658487b0d76eaefd119d585572b72f8cf789daa9b3e7070c461886d33df8120d389057f9ea278cb37964d878514e49711451be22cd218f7ecb846496c
-
SSDEEP
12288:rbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:rbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bc159e0f9536f64b6e6ed1b51f693cb2b62b82de2ca7b1450e2ef058ae01eb80.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SndVol.exeC:\Windows\system32\SndVol.exe1⤵
-
C:\Users\Admin\AppData\Local\Vvcn\SndVol.exeC:\Users\Admin\AppData\Local\Vvcn\SndVol.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\7Lf8l\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\7Lf8l\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Users\Admin\AppData\Local\e9yYva1\sppsvc.exeC:\Users\Admin\AppData\Local\e9yYva1\sppsvc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD577098b5d2d32b26e58d8857954ef8f7d
SHA1c26c207f91aba9acff3085416b2b90405d215fdc
SHA2562c203d51e3462b1cde35454aacf742fcbf88b01bba2afd1417729b7d69a46182
SHA512c757e1bb1cf740e91994ea0d5d44d52cedf3d6fba0689c665610cb9fc8e477d0ec7b14e3a8d5ef42fa385df2c2d3a2f0cbd74547d3b61ac15592629ba138f923
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
269KB
MD5c5d939ac3f9d885c8355884199e36433
SHA1b8f277549c23953e8683746e225e7af1c193ad70
SHA25668b6ced01f5dfc2bc9556b005f4fff235a3d02449ad9f9e4de627c0e1424d605
SHA5128488e7928e53085c00df096af2315490cd4b22ce2ce196b157dc0fbb820c5399a9dbd5dead40b24b99a4a32b6de66b4edc28339d7bacd9c1e7d5936604d1a4f0
-
Filesize
784KB
MD59bab32ebb21ff6ba77044d440aa078c8
SHA1aedafc5b5996b9689dfef5886b0b097d9ff4392a
SHA2569133454dd5a80288361d7d8bced29eb3a7e89ba11103fb69ac28b0878895e2ac
SHA512b393fd4597f177d17d922e9cf31a1495d37331a0896c37b82d650518822ffed39e440c16d0fecea5e582597b490c1d38212afe452b9e2e98976b22ef073e545e
-
Filesize
780KB
MD558f23e826af79ee648b21e9213f07547
SHA1f4e445d56cd002f3342883350db88995262c58c6
SHA2566a803d96bf89144257768c540d0c792e757c65be49294c52f590e426dee3c552
SHA512945f37ccd2c9cf6f57f3f7de9f14fccf9134b311ff0dd1bade4a07b7622c3787794682ff2454c3bf455da125681ee9751e587b66dd981610566a36637ca72374
-
Filesize
4.4MB
MD5ec6cef0a81f167668e18fa32f1606fce
SHA16d56837a388ae5573a38a439cee16e6dde5b4de8
SHA25682c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8
SHA512f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5
-
Filesize
1KB
MD53546de2ca5f5b9a6dbd4e8bc98e513e3
SHA1c6a6eb992235bbb25328568a16631d403c47f5bd
SHA25694b60c40b347b84f73524d4fd1e4a8148907666558ac4d9c3381ce160f77407d
SHA512f971f456abfe5fb1e1bd89d27ca15d66c804e67111060469f241a8dfe4b5e45caa9195068bb90a1f4673dddf1fa5327c91b45e929be68516b8ec91842d736ede
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB