Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16/01/2025, 02:52 UTC
General
-
Target
d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d.dll
-
Size
780KB
-
MD5
3fa092a0e0ea8a296e20322bcbdc38c4
-
SHA1
78a2adda053686d8a2ddba3ccd3a5e0f1672575b
-
SHA256
d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d
-
SHA512
f6b3df5593d62e42f289d59896082d5a4d2a093f01d31e3d790a07223e2ee8728942c5c0b3570fcdfbf79554db89f1c8affdadd42aa5dec2e409878785bd605a
-
SSDEEP
12288:kbP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQn:kbe42XV7KWgmjDR/T4a/Mdjmi
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d4d9ff199368067600f128d3d3ac1fcc3bfbf0cabfe64b14b8484731ae64117d.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RdpSa.exeC:\Windows\system32\RdpSa.exe1⤵
-
C:\Users\Admin\AppData\Local\6eclfqMj\RdpSa.exeC:\Users\Admin\AppData\Local\6eclfqMj\RdpSa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tabcal.exeC:\Windows\system32\tabcal.exe1⤵
-
C:\Users\Admin\AppData\Local\cFq\tabcal.exeC:\Users\Admin\AppData\Local\cFq\tabcal.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Utilman.exeC:\Windows\system32\Utilman.exe1⤵
-
C:\Users\Admin\AppData\Local\EvRzTewJB\Utilman.exeC:\Users\Admin\AppData\Local\EvRzTewJB\Utilman.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
-
DNS8.8.8.8.in-addr.arpaRemote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle -
DNS13.86.106.20.in-addr.arpaRemote address:8.8.8.8:53Request13.86.106.20.in-addr.arpaIN PTRResponse
-
DNS172.210.232.199.in-addr.arpaRemote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
DNS14.160.190.20.in-addr.arpaRemote address:8.8.8.8:53Request14.160.190.20.in-addr.arpaIN PTRResponse
-
DNS167.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS167.190.18.2.in-addr.arpaRemote address:8.8.8.8:53Request167.190.18.2.in-addr.arpaIN PTRResponse167.190.18.2.in-addr.arpaIN PTRa2-18-190-167deploystaticakamaitechnologiescom
-
DNS13.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request13.227.111.52.in-addr.arpaIN PTRResponse
-
8.8.8.8:538.8.8.8.in-addr.arpadns
DNS Request
8.8.8.8.in-addr.arpa
-
8.8.8.8:5313.86.106.20.in-addr.arpadns
DNS Request
13.86.106.20.in-addr.arpa
-
8.8.8.8:53172.210.232.199.in-addr.arpadns
DNS Request
172.210.232.199.in-addr.arpa
-
8.8.8.8:5314.160.190.20.in-addr.arpadns
DNS Request
14.160.190.20.in-addr.arpa
-
8.8.8.8:53167.173.78.104.in-addr.arpadns
DNS Request
167.173.78.104.in-addr.arpa
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:53167.190.18.2.in-addr.arpadns
DNS Request
167.190.18.2.in-addr.arpa
-
8.8.8.8:5313.227.111.52.in-addr.arpadns
DNS Request
13.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD55992f5b5d0b296b83877da15b54dd1b4
SHA10d87be8d4b7aeada4b55d1d05c0539df892f8f82
SHA25632f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c
SHA5124f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6
-
Filesize
788KB
MD5af00a5e82fe9d76265441a08f662d1d3
SHA1fdc51b8518ed830018b5f4b43464f79fbc322f78
SHA2567d7edfe3ee99bf23d3b69662c6d7fdeb7b47012092e29cae787b770ee52d9051
SHA512e8cdc856548df1c2db414f4c4b4fac5c6831e100e6d06da98c85a8b5a3cf9da941a39d7417d3d17dfd856e97405644cc8a3cf1b9e6086f13f073a17018304b5c
-
Filesize
1.0MB
MD5749b4dfae5773f39589c055546402a0f
SHA1c1cc36ae7e1e3cbf17e8cbe563db2d4c599dbc36
SHA256ff54a5e3d82084a7b8bc53ffa90edc3e4a9e13397aa484eb62f11d4cf4d42262
SHA5125d12a436584c736f2a194d8d41db02482a2c4c9c10caff83d44daa9bba67816241c512fa9f0af07d55073288ed32a49f332f04b7b898e4e46180aeaef2f4041d
-
Filesize
123KB
MD5a117edc0e74ab4770acf7f7e86e573f7
SHA15ceffb1a5e05e52aafcbc2d44e1e8445440706f3
SHA256b5bc4fce58403ea554691db678e6c8c448310fe59990990f0e37cd4357567d37
SHA51272883f794ff585fe7e86e818d4d8c54fa9781cab6c3fac6f6956f58a016a91f676e70d14691cbe054ae7b7469c6b4783152fbb694e92b940d9e3595fe3f41d97
-
Filesize
784KB
MD5735c2c6307438e421b74f6cfb88e1116
SHA10c0d85762e77f4b3d549a0422fd591138c0b9534
SHA2561ec4e31d8c9db0620d925d600700207c4b848d6107cf2cc0241f6eff77f1dc93
SHA512945fee40b9db681a915d5b5ead8aebbc6af4571eff6897fa23c904b82b8a01d5b4ed3c4ff9af28d7d04baa43032af73334c64318a9a42409ce208cc0628b597b
-
Filesize
84KB
MD540f4014416ff0cbf92a9509f67a69754
SHA11798ff7324724a32c810e2075b11c09b41e4fede
SHA256f31b4c751dbca276446119ba775787c3eb032da72eabcd40ad96a55826a3f33c
SHA512646dfe4cfe90d068c3da4c35f7053bb0f57687875a0f3469c0683e707306e6a42b0baca3e944d78f9be5c564bb0600202c32c223a770f89d3e2b07a24673c259
-
Filesize
1KB
MD5c63ab2cf72603b1f62d548781e8f4885
SHA10d424a5329731847fa8b6f5a61ac258d4052ce14
SHA2562a4d9ebfc16460e995f380e2aeb2d3e79fc47a8b37a88a9c59da0b1e11000513
SHA51274eddde003598e353eda18346ea271ad30d7548d017bc4a0e404ab48f59e5666db24470cfd4743ca917be7b0aec0e0fef1607248a714cb489d456880427bccb7
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
1.0MB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB