Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-01-2025 23:26
General
-
Target
3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814.dll
-
Size
780KB
-
MD5
12c235157458058ad181f648cf1fcb96
-
SHA1
8d7076f1a88190f2a4f2004e77ff973dd642f6c3
-
SHA256
3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814
-
SHA512
c46d5c8ba89760d9ce8649283e9980ecba0d8221fd97514d4e3abd0a8e6838dea50dd63d95ce01f2453aebe9dc5dc4e9aa33c15676d74e49115c83862e608807
-
SSDEEP
12288:PbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:Pbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsAnytimeUpgradeResults.exeC:\Windows\system32\WindowsAnytimeUpgradeResults.exe1⤵
-
C:\Users\Admin\AppData\Local\gihzR\WindowsAnytimeUpgradeResults.exeC:\Users\Admin\AppData\Local\gihzR\WindowsAnytimeUpgradeResults.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\iexpress.exeC:\Windows\system32\iexpress.exe1⤵
-
C:\Users\Admin\AppData\Local\0VOa5uB\iexpress.exeC:\Users\Admin\AppData\Local\0VOa5uB\iexpress.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\TpmInit.exeC:\Windows\system32\TpmInit.exe1⤵
-
C:\Users\Admin\AppData\Local\LzU06WJU\TpmInit.exeC:\Users\Admin\AppData\Local\LzU06WJU\TpmInit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
163KB
MD546fd16f9b1924a2ea8cd5c6716cc654f
SHA199284bc91cf829e9602b4b95811c1d72977700b6
SHA2569f993a1f6a133fa8375eab99bf1710471dd13ef177ef713acf8921fb4ff565a3
SHA51252c91043f514f3f8ce07f8e60357786eb7236fcf6cdcccca0dd76000b9a23d6b138cebcdec53b01823cb2313ec850fc7bece326ec01d44ed33f4052b789b7629
-
Filesize
784KB
MD52067b8db2158d67518fdcf2fbcb34bed
SHA1c7178043fb838430252848856c8d192d90d264d2
SHA256bdabd993d279d13a7feaac815ec98e574f99506d283c281f742a63af52d63630
SHA512c763fb31b054d4b51c08bb6304c970ff787b358e43099fdaf7f3b5a19742395548646640182a31569381000c62761b92c9ec3b877169e51b2dab4580c711fefe
-
Filesize
112KB
MD58b5eb38e08a678afa129e23129ca1e6d
SHA1a27d30bb04f9fabdb5c92d5150661a75c5c7bc42
SHA2564befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c
SHA512a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d
-
Filesize
784KB
MD50c5e7a1f9cde81633bd579cc4f4dfa58
SHA1be535c84c1d92d1a0c42caa8eb3331f3b08f6637
SHA256ed9612fef071ab9323004a7970879efd263180e01b653bdbd27af24f890324ce
SHA51215942a6d6b948769f54a2fda97fdaefb932ff2bb3700e8425ce2e57e91663672be75e450078321451af145a7a7ea1cfe4c823af852f7d75fd1c4d2390a946bd4
-
Filesize
1KB
MD5699c1df0dcf96301484bf1e7302e7e15
SHA1fb9772b3cad3b04cf8dc11aacc931e794c317a9a
SHA2563edfdd4f33c58724fbb6f746288c584898f26d9e8f2c031790f85e39e223f069
SHA5125ffb2ab9f2cf0ebe42bb7eef542094342b748f73d4b517ec386aba8d9d542827ff17f1b2e09226c6ca0c16937f21197757500dbc2ef9e9e7e37f3d5e6cc9d72f
-
Filesize
780KB
MD5481debd853216de941f8de074ae2c79a
SHA1a205c1f9cca86c01ed9178bef78f7d4e243ec3a8
SHA256094f845986c2b433e16f44582b85e366db23788a2fd4a5e4a4285d15ca37fc26
SHA51271e0560a55761872899e37c4d8d489455bd7dcdcc28f3ab75fafdb4e59cd03a0d8e558e6c862a432efe4cc3a7995edde2303da5b0bd9f9efa37a0070f5b5d892
-
Filesize
288KB
MD56f3f29905f0ec4ce22c1fd8acbf6c6de
SHA168bdfefe549dfa6262ad659f1578f3e87d862773
SHA256e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b
SHA51216a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB