Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-01-2025 06:28
General
-
Target
b723987104cf85aaedc0a5dc457d13be8fa1e12526a8b59551729bcc9b0a6247.dll
-
Size
776KB
-
MD5
435455aa73a48604914eb8271db3b4a3
-
SHA1
8d321b4bd4eb646f18e6507fff8eaa1f93982375
-
SHA256
b723987104cf85aaedc0a5dc457d13be8fa1e12526a8b59551729bcc9b0a6247
-
SHA512
797db5b4854395b5b4a0904abcf3e56b43d99faa507c70954216128dcd2861566d78a0d9e6f573aa7ffa3eb220212911e9a8e54a20bc7d0d01e1e0cabd81610f
-
SSDEEP
24576:1WyoqFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:gKuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b723987104cf85aaedc0a5dc457d13be8fa1e12526a8b59551729bcc9b0a6247.dll1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\l1SPYdqg\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\l1SPYdqg\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\0LLiHDoJ\mblctr.exeC:\Users\Admin\AppData\Local\0LLiHDoJ\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\icardagt.exeC:\Windows\system32\icardagt.exe1⤵
-
C:\Users\Admin\AppData\Local\mS4S11\icardagt.exeC:\Users\Admin\AppData\Local\mS4S11\icardagt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD54de2877888c854fff4a14c6c23d113fc
SHA18f87892ecc461bd84b4cc0c3233b7b23436ef46a
SHA256ecd23123b651c9da901948491bfaa340bb7846eb556b27313fe5625ccf18371f
SHA512a83d812e781787825afe379f5e6a3b88d2c553c5bd2d9cfcaeae164dab00adb3cd9009b516b1b215870a6a4d602cf0e66c2aef5d8740448675fe6b17a50ca368
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
776KB
MD56546a2fec9546a5544198c4d0505744f
SHA146cabb577f518f928a3c60d4bc09b65c94380f65
SHA256e549ecd21d92227fa4a8294230df643444f242e0dc80a8b0e54c50a159d9e095
SHA512885f66b48b308f90684a0df785084ca4a3ec425f12137d7cf212eeafda728407c0b14cd16e4a637837d429b9809c9ba89134a55fb705db9f1266235eade0aa7b
-
Filesize
780KB
MD500522cfdc0a5dcbaa43c1181578e7259
SHA1bafca2f5992bef20d0f280a3b5645d82d852aa5c
SHA2566cf95637b08706ebc3bdb66e278b66b2041ed6dee64979d4b8d1454a90082bb3
SHA5125d41c6329cd37523c09d6523746833c1f8b1f6483ba8af499ea2a34e00db0cf35b7fc1d92b396f2591f168db2703d61be6a3ca6487718d4f36e52c7b0e022de1
-
Filesize
1.3MB
MD52fe97a3052e847190a9775431292a3a3
SHA143edc451ac97365600391fa4af15476a30423ff6
SHA256473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7
SHA51293ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a
-
Filesize
1KB
MD53c130945906b460a21d37618f9fa9456
SHA12ffc10210df1c9e2e94a6e523f0e4445fb348c61
SHA2560d5c23fc16249171f5c64bc8bea945e672c61f3ccc28413f3904040f64db3a92
SHA51235ada0273452eec877310fe8b59766d2e1f39bc4b7a53e8ea270adf4b94b2a19be8097d1b715f0b2a16959a2528b77d2d12f7514c4fed60e2871e2239fc296df
-
Filesize
80KB
MD5e43ff7785fac643093b3b16a9300e133
SHA1a30688e84c0b0a22669148fe87680b34fcca2fba
SHA256c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b
SHA51261260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
776KB