Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
16-01-2025 11:56
General
-
Target
899bcc783c6c38bbc60b714b79c0bd93e7752b34dd0f3ed1020837d65441b15f.dll
-
Size
768KB
-
MD5
c8943ebd87a704959163401518291eff
-
SHA1
436ad153aa4e9c163b885519a4b32aa69f0dca8f
-
SHA256
899bcc783c6c38bbc60b714b79c0bd93e7752b34dd0f3ed1020837d65441b15f
-
SHA512
bd9a2fc83e68f853ebe4798f192b2d033ccad0d24d29eba410d160a55cd5fad49f3f74f1bed6df3110bcb69216b642bd90c5c6536ac71d61ed9b014aa9ce324e
-
SSDEEP
24576:J4ld9/EkwVK+KFjZBxJ4PgGnMsMryIxNB:JK9/EkpVFjPxeftBaj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\899bcc783c6c38bbc60b714b79c0bd93e7752b34dd0f3ed1020837d65441b15f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\javaws.exeC:\Windows\system32\javaws.exe1⤵
-
C:\Users\Admin\AppData\Local\65vke\javaws.exeC:\Users\Admin\AppData\Local\65vke\javaws.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msinfo32.exeC:\Windows\system32\msinfo32.exe1⤵
-
C:\Users\Admin\AppData\Local\mYRBNa\msinfo32.exeC:\Users\Admin\AppData\Local\mYRBNa\msinfo32.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\3Tvsk3e\consent.exeC:\Users\Admin\AppData\Local\3Tvsk3e\consent.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
772KB
MD50e59595a5f30f3e506a5d18d4eb5ccaf
SHA1fef10ca11f05bbdaaf32e5109607dc27da792d7f
SHA256331b870744ed8d1899fdf0a63f05dd7b97a4d7b0e89ce67939e08c8be175c8ca
SHA512717efa167aa592e88e25f78d83a443267521dcbd8950a53c2c1cde935595cf2c73137ccdf64f4821ee97794ab67842900e7847b4816b0f9f8ce9ae57b3ef59bd
-
Filesize
109KB
MD50b5511674394666e9d221f8681b2c2e6
SHA16e4e720dfc424a12383f0b8194e4477e3bc346dc
SHA256ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b
SHA51200d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7
-
Filesize
772KB
MD5e7125f481e3baa4ceb111a9532149e5c
SHA18a9efc036952da27ea78dc5466b1d453090cb9f2
SHA256478653a5330027c4740d2e67a7faae2ad8a942f86f9a26b81b2bb5a995add592
SHA512b85a305208ed060ece3e5cfc27d48e708f350de93fd8177f9d213477ae74a65dbbe5b45d1eefd591c2bb1f374102394fa3c53d54bfcde1bfde05daec7b7dab15
-
Filesize
796KB
MD5dee72d593fd88f317a246fb9333260f4
SHA11fd64617f0f7109175597cb9986a97e75434036f
SHA2565b053c0fdaa52110a4dbd0881809c07a4725273186ba5c8d31f361c5e81b444c
SHA5128050084b6191816fb03d83331f4e11871b8fe8cf44686fdd3dc9547840b608a9584403da4b01e71cd64edf4a9821ceff2968c4b05de5e2c2c1e6cf90abd2426b
-
Filesize
370KB
MD5d291620d4c51c5f5ffa62ccdc52c5c13
SHA12081c97f15b1c2a2eadce366baf3c510da553cc7
SHA25676e959dd7db31726c040d46cfa86b681479967aea36db5f625e80bd36422e8ae
SHA51275f9bcce4c596dae1f4d78e13d9d53b0c31988d2170c3d9f5db352b8c8a1c8ca58f4a002b30a4b328b8f4769008b750b8a1c9fda44a582e11c3adc38345c334b
-
Filesize
1KB
MD5c7172d0dd13c8372ce7a1d76dd4365d1
SHA1ff2058f01b1b52f6a6fbc52ac8a1e8fafbcbe720
SHA25641fbbf73f524688b38e2b6c112b986ef41965299fafb6aee7bf0083fbbc0a956
SHA512db0f89a0e3b078bb92f0b563599b453a67e6a001eb01b9f2b8ecf0cb9887d90e9c0a2593a36038f5bbd7553ed79ef6957b41d340dea75e53953ba248a68c0b99
-
Filesize
312KB
MD5f94bc1a70c942621c4279236df284e04
SHA18f46d89c7db415a7f48ccd638963028f63df4e4f
SHA256be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c
SHA51260edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
768KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
768KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
772KB
-
Filesize
772KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
772KB
-
Filesize
28KB
-
Filesize
772KB