Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-01-2025 23:26
General
-
Target
3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814.dll
-
Size
780KB
-
MD5
12c235157458058ad181f648cf1fcb96
-
SHA1
8d7076f1a88190f2a4f2004e77ff973dd642f6c3
-
SHA256
3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814
-
SHA512
c46d5c8ba89760d9ce8649283e9980ecba0d8221fd97514d4e3abd0a8e6838dea50dd63d95ce01f2453aebe9dc5dc4e9aa33c15676d74e49115c83862e608807
-
SSDEEP
12288:PbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:Pbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\3fe07a9b47a19d1e5bd7a3ab151c4702292dad575ccee38241c830a55f285814.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WMPDMC.exeC:\Windows\system32\WMPDMC.exe1⤵
-
C:\Users\Admin\AppData\Local\tzhbn0\WMPDMC.exeC:\Users\Admin\AppData\Local\tzhbn0\WMPDMC.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\8xVdu\wusa.exeC:\Users\Admin\AppData\Local\8xVdu\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dpapimig.exeC:\Windows\system32\dpapimig.exe1⤵
-
C:\Users\Admin\AppData\Local\OX4346GPP\dpapimig.exeC:\Users\Admin\AppData\Local\OX4346GPP\dpapimig.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5a6cbd3afc74789e6ec12e7e030e83e72
SHA15c4704a20270f9b7fda9bb15625eb4acdfa9404e
SHA25698d53eb986f3be07c9986d1a26f3f11c3b79196f0d57cc28bfa5dd377a54e6a6
SHA512fc0b7521092776f5e38e90a07f366bc663127babb35af5ac9087fa0f43a2a865e1b344729573971e782901dd75b37143fc952a6f3dd7062e9aedb3f46f6936ea
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1.0MB
MD5aab50c6d058a445e7eacd2d6147178d5
SHA1e0a87cfcf8c318ea464921d438f4db43ace420f4
SHA25621a896429f5ec616079405c14dbe052071f36c47702ca4cb8ef67097c84747bc
SHA512042d2b4d24b66991805eea48c673dc12238c84ef5279df932bf7f10b988dba3bce6dacfa3672fa42b46499dab205930993009e1f32726dcae1b13bc456dcb690
-
Filesize
76KB
MD5b6d6477a0c90a81624c6a8548026b4d0
SHA1e6eac6941d27f76bbd306c2938c0a962dbf1ced1
SHA256a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb
SHA51272ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe
-
Filesize
784KB
MD5dfab9ba8ed794055266ee44c33b2fc2e
SHA164c3775c7a59c7d4b74e652dafc0331c1862fbcb
SHA2561edd4fed114421cf8f5326c505f223f8cedfb6f1c20ae7f473b2c5b81453d6d0
SHA512b7330bcbe3af4941233fb827e9f4dbe8d2dcefb996b08c8e1e935296caf91580bf2ef8afe94501e23eba536e25055bec94186972b7c19f9c12689a6bb1ac59bc
-
Filesize
1.5MB
MD559ce6e554da0a622febce19eb61c4d34
SHA1176a4a410cb97b3d4361d2aea0edbf17e15d04c7
SHA256c36eba7186f7367fe717595f3372a49503c9613893c2ab2eff38b625a50d04ba
SHA512e9b0d310416b66e0055381391bb6b0c19ee26bbcf0e3bb9ea7d696d5851e6efbdd9bdeb250c74638b7d73b20528ea1dfb718e75ad5977aaad77aae36cc7b7e18
-
Filesize
1KB
MD5fe6649bfa356f9cf9427fd62e3cdf883
SHA1f91893cd1e60fee94f64db42399b804a5fd75ffe
SHA2568286ca89b6e4b93ff038afa64106a361a37755bff5dd7bff6aaff8c958219a6c
SHA512c0d49f71b30037c091fe8bce0619efa9c7a387413d235a611b0f41ec129ec47f626b509eebd47b32cfd7fc2a0c8d1628f84baf8a0ff2bdeb1989e5086d04f195
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB