Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 23:00
General
-
Target
b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6.dll
-
Size
788KB
-
MD5
3736823fd2de325ff15849e82629cddb
-
SHA1
9d87dac4828e2899fc0929af37b2b7a5f6431186
-
SHA256
b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6
-
SHA512
c6b5dec2b177ef5e1236b6867745dfb09dee853ae2fa515aacaf7bdf6c10216a7da3e9e62918e92da1a8509e03674d785a39ebf83c75b912fbc7d9ab23750cbe
-
SSDEEP
12288:ibP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQW:ibe42XV7KWgmjDR/T4a/MdjmJ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\b325149f6f6227fc9512a5d5d7f8c552ebd4dd7433306e2eac0c42ef75f6cfd6.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\A4aRqVP\slui.exeC:\Users\Admin\AppData\Local\A4aRqVP\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\8ZMSEhL2a\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\8ZMSEhL2a\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationSettings.exeC:\Windows\system32\PresentationSettings.exe1⤵
-
C:\Users\Admin\AppData\Local\998zg\PresentationSettings.exeC:\Users\Admin\AppData\Local\998zg\PresentationSettings.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55846c1febb8261c907f95d03cf8db1b7
SHA11830f1c50d19241bdecd6c3ffe9717640ef437ae
SHA256209bf45741a650e472bde3bffa6e777f26c452d0d119e2f970f38b53da62448f
SHA5128e477666cc977ff8956bcab30cf8f6d127d2c45704fd4e3a9bdae1604edeb870b9d705cb4739bdb91868bb4c8a6d24eaf80f58fbada453406bbd1807baedd3e6
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
219KB
MD5790799a168c41689849310f6c15f98fa
SHA1a5d213fc1c71a56de9441b2e35411d83770c01ec
SHA2566e59ab1a0b4ac177dc3397a54afcf68fcea3c1ee72c33bd08c89f04a6dac64b8
SHA5128153b79d4681f21ade7afe995841c386bff8e491ad347f8e7c287df5f9053cae7458e273339146d9a920ceaa2ba0f41cc793d7b2c0fa80efbb41477d39470866
-
Filesize
796KB
MD57ed9a540a4e37a45ccc718b7c2783eac
SHA17bc443379dc9938d013e1128e29efbdf878671bf
SHA25697c967ec9178a9f3a692385e8d3343a5f8aed627b5ab44d66c8dc3a444f97d58
SHA5120eb8e9628b5ee0337a595b65a2ed31e6b667dea6596c9abcac720c3e8e35b1c8b98ddf0fbe8935366d5e3d9bc329839a89db781d2ca75d47158e552d383ce1ef
-
Filesize
792KB
MD54d61abbe5ff37f749cc9a205fa1b9528
SHA1903d8eff5fa8bb314c8e7208d51e1af66ce5a0a2
SHA256c269787441d0fb5d48bc83ff88fdccce5ce2b9487d4ff106f4b0699b6d49a304
SHA51253f157d0b7c5cb3a145d4ed6e00280560ae0a9059b5fc4f2d1bab92875164ed3af8d2fda8a39a91e467363b5db8c35d20d693d4066398444ffec80decd2fb014
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1KB
MD57884f8a7f510b58034f826bd7e477506
SHA18980ed0f23a2b557dacf6f34f51c91352688d4d5
SHA2561783e5539ac0f6c318913ddc5a540b8a85716f0bdb55abf958d70a3e2fca3361
SHA5129334e1e90555d6a8b39c11bd7fd810f9cbfdddce7eb7d4441f7224bd02a04a1b6589fcc33347acbbc312744062921c9faa9d445b0e6ce8f733d814eb3a5bd5d3
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
64KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB