Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
16-01-2025 02:22
General
-
Target
7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02N.dll
-
Size
780KB
-
MD5
775a049f3b2398ff45264c04593ff930
-
SHA1
5e9196f8fcf4c5de7a6ccc6735448f32e3bd0b8e
-
SHA256
7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02
-
SHA512
f57692d7ea085e6c203f760c4257f7b963f6e9dfbcc168612664069b68539825754d0729f30854fd435932eb7e597b2ccba11bec90961cba21a5b85c24e6444a
-
SSDEEP
12288:kbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:kbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rrinstaller.exeC:\Windows\system32\rrinstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\Nyvm4jVg\rrinstaller.exeC:\Users\Admin\AppData\Local\Nyvm4jVg\rrinstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\dvdupgrd.exeC:\Windows\system32\dvdupgrd.exe1⤵
-
C:\Users\Admin\AppData\Local\vopO\dvdupgrd.exeC:\Users\Admin\AppData\Local\vopO\dvdupgrd.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\6X06Q\mmc.exeC:\Users\Admin\AppData\Local\6X06Q\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD516938caf3517dff7b8b01ea13eb27965
SHA15388141b421468af2264fe38f31812f6c4e06a24
SHA2566ae526487d408a4ef9235b9251206e8d045b988fa33b005866422584e1bdcc2a
SHA512f693a5104326dc18fca7c27065c176bd917b509f18be7a6b65e5ded9e0eda9aee529b2462f1f3b87c475034ddc44529bc74b058a0872b3e972f8daa7c41f296f
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
788KB
MD54a7f36a503fb5c9da297ac091a0ef8e7
SHA1359b1152f1f80701da67cb73cf0e384ceee8f175
SHA256a57d6fd40d99980844159ad10e226f93406af9a87f12f1d0ef155081000896e6
SHA512f7c08c396dd263ce93178e42d0c0aa8c7b06c532d77c3308c874a09d40d14faefe3e8c5114546ebb6dfbd4df824edbd95776efed34d089d0f56ad69738d85ec0
-
Filesize
780KB
MD565116a08299263bd7d8ddf7e827f6951
SHA16b1ae4b68941016f4a8135c7f3e6905949418cf9
SHA2562ae0ef518c6a4a7a09e2f0c6f628e2b79753a8d088a35699d396fc84408891e6
SHA512ef44de1d92747ecf8c3cd11f09e8fdccc30768213806ee53dbb99780fe3dd968ffb82b1b6d5cf5e5f473ef9773d32692c0a2c1c8f50efda5dc8ad4d1d8b0b3f4
-
Filesize
998B
MD5421b14faa5d8a6f61cd2f2ec678697fd
SHA137beb2ce8485e9b14a2febb4f97e505595b576a1
SHA256e27abc729b43c08c1bac10cea5e2438dcfd7a685098b40350aa3190ca07b575e
SHA512919a24c0c45139a35395d7f800e7a22ac14a33f37224428b7d808e5daffe84cce4e27f2d0d6e3a76a97dec99e6411098acfe7bd6a0f31134898a6d423bf1765c
-
Filesize
54KB
MD50d3a73b0b30252680b383532f1758649
SHA19f098d2037e4dd94eca6d04c37b3d4ad8b0cc931
SHA256fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc
SHA512a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4
-
Filesize
25KB
MD575a9b4172eac01d9648c6d2133af952f
SHA163c7e1af762d2b584e9cc841e8b0100f2a482b81
SHA25618f9f520c7157023b0e7dfe7433a63c4dedd47b04d24aac4038b795893050736
SHA5125a7a2c7f184efd9c84256a1a0a5e7aeb95432d63a567196be54e7a9437a5ada9b922983c5fc0cafb16eab4493665d8e56e2f646f9f6a2d6179986925ffcdf769
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
2.1MB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB