Analysis
-
max time kernel
119s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-01-2025 02:22
General
-
Target
7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02N.dll
-
Size
780KB
-
MD5
775a049f3b2398ff45264c04593ff930
-
SHA1
5e9196f8fcf4c5de7a6ccc6735448f32e3bd0b8e
-
SHA256
7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02
-
SHA512
f57692d7ea085e6c203f760c4257f7b963f6e9dfbcc168612664069b68539825754d0729f30854fd435932eb7e597b2ccba11bec90961cba21a5b85c24e6444a
-
SSDEEP
12288:kbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:kbe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\7d0d0741e73494cff1e171462a4ea59722bac96b61e879434a8bb9db08ff5e02N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\bfqY\rdpshell.exeC:\Users\Admin\AppData\Local\bfqY\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\jF9HjAoEo\slui.exeC:\Users\Admin\AppData\Local\jF9HjAoEo\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\LicensingUI.exeC:\Windows\system32\LicensingUI.exe1⤵
-
C:\Users\Admin\AppData\Local\8MgbakHh\LicensingUI.exeC:\Users\Admin\AppData\Local\8MgbakHh\LicensingUI.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD55bfe34e7dc769ce77a642fb8dacdb9b6
SHA11f06e192908c460c63a9df4e20308e95e5d15bd1
SHA256ba0504523406ab856ca2aabfdb07dcfad76fbee5861348b36fe5fb9df3d1c027
SHA512dd9791cd7d52ccda6236207666901b88f6031de208c362dde05cf467aae1e161e3833ebf998f8a673ae634e0346168e25bd33bf115d676d13710baff9163a7c2
-
Filesize
142KB
MD58b4abc637473c79a003d30bb9c7a05e5
SHA1d1cab953c16d4fdec2b53262f56ac14a914558ca
SHA2560e9eb89aa0df9bb84a8f11b0bb3e9d89905355de34c91508968b4cb78bc3f6c5
SHA5125a40c846c5b3a53ae09114709239d8238c322a7d3758b20ed3fc8e097fc1409f62b4990557c1192e894eabfa89741a9d88bd5175850d039b97dfdf380d1c6eeb
-
Filesize
788KB
MD5b9e072c745c29aa4523670e4471d51f9
SHA11cb2308918747a4cecaf01d32fe9b90f030d9795
SHA2567d3ec5b4376fc7cb0bf88a12c709e54d95887bc4803590baf28c4a00a7dbaaee
SHA5124da9c92a24ec0fbca4bb2bcebc15970a2942ea78d0e1a4aeb814a304db2239b3227f488eab0a52e2529339b40d2c689bedaeb3ee22948de0ce644b4d75886fa3
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
784KB
MD5d10db424d12cd33aaeaa379843a5e187
SHA14e02bd3ef7b2a54b9dabb51f58c1058d8a090d2e
SHA25607f40963df0203cfbb609269d5bb735a111295b3bfdc0f04faff249e90f66337
SHA51274240e04b7fbccbaad5469e0f3899da959900a35da978a5749cf8f572438525acad0f8cb8ada6006f3ec4de400257ad8aade9c78ebeaf16cef50a225cfd00239
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1KB
MD50d178f810ecd171b59d38902c92d2657
SHA12da2bfab136cbcc14fa000a4debad3b35f1e34a7
SHA256c751bbe24cf5964fc6270dc3aecae359c536e2bbe1479764f740d00d0c910116
SHA512034572eb2bb9268fb5d488225a1eed5ff21cd8c19c0b412d3ad4201aa6cacd3f0209845bc97ea489814ceede70391aac543cfbed619111f7d753cc5ae5a85108
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB