Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-01-2025 02:52
General
-
Target
d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d.dll
-
Size
780KB
-
MD5
3fa092a0e0ea8a296e20322bcbdc38c4
-
SHA1
78a2adda053686d8a2ddba3ccd3a5e0f1672575b
-
SHA256
d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d
-
SHA512
f6b3df5593d62e42f289d59896082d5a4d2a093f01d31e3d790a07223e2ee8728942c5c0b3570fcdfbf79554db89f1c8affdadd42aa5dec2e409878785bd605a
-
SSDEEP
12288:kbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQn:kbe42XV7KWgmjDR/T4a/Mdjmi
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\ddodiag.exeC:\Windows\system32\ddodiag.exe1⤵
-
C:\Users\Admin\AppData\Local\UvZtv\ddodiag.exeC:\Users\Admin\AppData\Local\UvZtv\ddodiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\j7I\rdpclip.exeC:\Users\Admin\AppData\Local\j7I\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\unregmp2.exeC:\Windows\system32\unregmp2.exe1⤵
-
C:\Users\Admin\AppData\Local\CrM9wT\unregmp2.exeC:\Users\Admin\AppData\Local\CrM9wT\unregmp2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD5672fc6babd077dafb755c7a6a237d8b4
SHA11970cf132eaa13a0bd46e6d1125e61c5921a7f75
SHA256f4f1cd0902514be37c3f114b4c61973c08f2b7126829ad0976d7b35eee92e219
SHA512e566881878be9e75a7760db8a43941fd60bff819d3f3dc5239961860a24127fcdde3537c36a6a2d3aa8d0a62d46a751eb64a3238c0fd93e2deb0bfbf02c2eb69
-
Filesize
780KB
MD5c9a0a902c87205ae8b4e407c669e580b
SHA1b2e58ac8e58b9f5b70abfafb318b7d8706bc79b1
SHA256bc7d5b96c9f4214e75e7c758502beb1316760848eaa107f4f7e05f6fd8fcd9a4
SHA512e565338edd11846b031cd363e5763e14be94c89c14090bee087922099e524df6a8b55ae5df126642d6beb67a0d4aab5a4589463c94c912dc6cefb77411d76c1d
-
Filesize
784KB
MD5e2fb8a82172f123eea393a82e1192735
SHA1c72e9d5432cc6ef65568079bd77883d287b2ec8f
SHA256d2c7bc90e0d9663bda546bdc837c1c14f024680d9531fb1539602105bff8bd56
SHA512545b13e942e9721fdb8b166c067f3a00a7bf4480c3d8c3a20a2d31ecc90a13440296ec5f6157ce9d9bffbb9fe4e6d8d002f5905d510590bbb1cfab1491108c15
-
Filesize
1KB
MD5618b210600b6eec0a5c1c7b16c26b256
SHA1d7a1cfd2ada938cb9d77e174fb363e429cc37a47
SHA2560f3deed14b1ade7a401bc0844f776af04baf2c678db1c666fd428c89830b8eed
SHA512819655b2e75a0a113ef29be622432536f1c7737c1e75319482d67b921caace738f1c5f12aa7359df772ec88d97b637d1409620d927aad125e473b091d03d65fb
-
Filesize
316KB
MD564b328d52dfc8cda123093e3f6e4c37c
SHA1f68f45b21b911906f3aa982e64504e662a92e5ab
SHA2567d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1
SHA512e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00
-
Filesize
42KB
MD5509f9513ca16ba2f2047f5227a05d1a8
SHA1fe8d63259cb9afa17da7b7b8ede4e75081071b1a
SHA256ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e
SHA512ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
8KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB