Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-01-2025 23:00
General
-
Target
b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6.dll
-
Size
788KB
-
MD5
3736823fd2de325ff15849e82629cddb
-
SHA1
9d87dac4828e2899fc0929af37b2b7a5f6431186
-
SHA256
b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6
-
SHA512
c6b5dec2b177ef5e1236b6867745dfb09dee853ae2fa515aacaf7bdf6c10216a7da3e9e62918e92da1a8509e03674d785a39ebf83c75b912fbc7d9ab23750cbe
-
SSDEEP
12288:ibP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQW:ibe42XV7KWgmjDR/T4a/MdjmJ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\j7LT\msinfo32.exeC:\Users\Admin\AppData\Local\j7LT\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\Z2g\msra.exeC:\Users\Admin\AppData\Local\Z2g\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\S2SI\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\S2SI\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792KB
MD5e6947189f7f1e9dc31251101dfa46cb1
SHA1d09f7ac58c834b50881ef2a78e4a41f47441315b
SHA256cbb3a9079d47cc496018bb218f8749305f30966b125500dbd2bb2c963ba1ff07
SHA51206a229bc7c06fbf4ea191cd2f321c1150f2869a21d8f1c24123682871ff82065ba6b5c4bdddf7dd7194cc9d740063d65d7f39deea1e4e4d2dccfd6b314c79e23
-
Filesize
792KB
MD502d182e4945199c4bb76a067af9e5a1d
SHA19f40222e8161aeb7eda9176adc4b47755a0b2b67
SHA25685dff69ec2a31aab3c7ca3a6d223a5d88c9e0a79d9cd29db350237b692598e4f
SHA51266336d5da1fc1a2554ee50e32ccb3176fa605baa39f54864c6c93daf30ace364ecff13686265b92311e56869bf729b71bf252f05607aa74150ca82aa62f5e918
-
Filesize
816KB
MD5122ef3c31cbe5dcfb48167e6b58af887
SHA12016aa78769fff07720b6bef6b686a993dbfa4ba
SHA2566e90d5dcfbedc81feffbf07567b07eefa33ea286a3a766316a8f392b9c7becb5
SHA512d438f8bc3b1bb298d6e70563964a4a658f3967d568b634b4a2588843b865c66a5998a0f33a2b57ec2feeb3ddcb6c27b4f14d183eaba21fa4441a13f00407c188
-
Filesize
954B
MD584b7ac56c394c19acbd7d44d898d0f8b
SHA11c2af04624e4c6f64bd57b753b97a2266d332671
SHA25664c9df561695695f0cd55219fb4b94df42b1add73c270ef90ed4a502cf777da1
SHA51253ab215b7d0f58c1df15edd118f837f7afc23adc7fa4b71534d5e692a6f51b71be8f0eda316d446b9482d117ebf4ca57b86d92caf67aea1ba302061553b1e827
-
Filesize
98KB
MD573f13d791e36d3486743244f16875239
SHA1ed5ec55dbc6b3bda505f0a4c699c257c90c02020
SHA2562483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8
SHA512911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af
-
Filesize
636KB
MD5e79df53bad587e24b3cf965a5746c7b6
SHA187a97ec159a3fc1db211f3c2c62e4d60810e7a70
SHA2564e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d
SHA5129a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
792KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
816KB
-
Filesize
28KB
-
Filesize
816KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
792KB
-
Filesize
792KB