Analysis
-
max time kernel
120s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
17-01-2025 04:58
General
-
Target
5f40fbec7483c678b7c827fd03e09068b8d95072ad350f27915c4e40889da7bbN.dll
-
Size
788KB
-
MD5
69de4bfc31cfc35a3dad7ed9eee22670
-
SHA1
69d8d4ba7eb29d52a748e065491396ce182831f2
-
SHA256
5f40fbec7483c678b7c827fd03e09068b8d95072ad350f27915c4e40889da7bb
-
SHA512
c993ff43d75b5ba6c616df1e408268c788542c61c277038fd84db93553334c2b54de3d3bff1aed2464eb4e593be2b809003b28531b4a9016b0f76e163a3d36fa
-
SSDEEP
12288:ibP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:ibe42XV7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5f40fbec7483c678b7c827fd03e09068b8d95072ad350f27915c4e40889da7bbN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\gHrlqi\slui.exeC:\Users\Admin\AppData\Local\gHrlqi\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\oTUcPUX\mblctr.exeC:\Users\Admin\AppData\Local\oTUcPUX\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\CHqo\rdpshell.exeC:\Users\Admin\AppData\Local\CHqo\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD509afdfcae794fe6f07d31cf2a5179dbc
SHA1ee3788bf7a39bfa73bbec224d6b136992cb5fdd1
SHA256eb4367e253dbcc0e4ffca8688788ff33e8a8873f05ad883b13963e8f75303b4d
SHA51293a85f91d32757286dcb79409148e6264e88e6d154e4e856a544609990eef3526a1e868cd4f4ab9e2b4a1108ee26020e9d7cea6c2f9f9541be9fddd8abe89e69
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
1KB
MD597eca00125de6d9ba2a621048f08a1e1
SHA1903c1687e84d7e2740077f9fcaf46e722dd19aea
SHA25604526712dfc6c442e570c399765871320e4fd3e24735b26d378d26a727d5e41c
SHA5121ac55e522ed2ff80550f7a1f34f20a9b64f11f19eb0aef911c1e78aa115497dd96c4ae058fe29d5c92ba25b29de7943bb14cc423c93844fea599647122d6a67a
-
Filesize
792KB
MD5430b03635eedba7d5e72b49ccb858799
SHA1e4a45c3fdd8c5bc59f25d1be84992ab9e9251161
SHA256e80ef7bc40382cd8976896368fb5e5a6fcf95b844c6a3e34a56dd7c3d7eb8b90
SHA51253bb75016d006dabeec49645a1f33773a7077e4fc68b16b156ee501c438ab60445731c79a0fd579a229f9346e72e0b3615cb1e0ff6e56d8a188057c4a9ea2632
-
Filesize
292KB
MD5a62dfcea3a58ba8fcf32f831f018fe3f
SHA175f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b
SHA256f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e
SHA5129a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603
-
Filesize
796KB
MD58244769e503a2961ef3bc6392698d83d
SHA1d5dfa05d79dcc1e1cb22239b859e514bc23e87b4
SHA256ac198308277a6f5c86b0f55bb6682d6d629dd05c4133747fb2e439bc2c20ad17
SHA5128f44ba671d99bbe88e8e2508d7e78cd0ee32a0cfe97fd7033d46a9adefc20526ac940c5c7dab5fa06144810968ff64bbc6b22bcd1e5baa4b744858a10ae5f41e
-
Filesize
935KB
MD5fa4c36b574bf387d9582ed2c54a347a8
SHA1149077715ee56c668567e3a9cb9842284f4fe678
SHA256b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f
SHA5121f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
792KB
-
Filesize
792KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
796KB
-
Filesize
796KB
-
Filesize
28KB
-
Filesize
788KB