Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
20-01-2025 00:37
General
-
Target
a6f60e617596fae22bfc758d49593f3a413ffab053d4d37128849496bc82100e.dll
-
Size
776KB
-
MD5
267ebe7f32597e6cbbd20590a180d77f
-
SHA1
12acab01e939ca2cbd0b2d419a5292127f76f91b
-
SHA256
a6f60e617596fae22bfc758d49593f3a413ffab053d4d37128849496bc82100e
-
SHA512
15d78c31ce57f90230c0a9acac167791197b1178e1a7cb9988f71b953f3c3c3a8ae4d522fe3ec8b4091b99b1e5b98929c46a32f5f3e796e0facf8f35a0557d67
-
SSDEEP
12288:fbP23onr2XO7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQg:fbe42XO7KWgmjDR/T4a/MdjmJ
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\a6f60e617596fae22bfc758d49593f3a413ffab053d4d37128849496bc82100e.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MoUsoCoreWorker.exeC:\Windows\system32\MoUsoCoreWorker.exe1⤵
-
C:\Users\Admin\AppData\Local\43c\MoUsoCoreWorker.exeC:\Users\Admin\AppData\Local\43c\MoUsoCoreWorker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\BxwryXB\EhStorAuthn.exeC:\Users\Admin\AppData\Local\BxwryXB\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\31g9ox6Av\mblctr.exeC:\Users\Admin\AppData\Local\31g9ox6Av\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD56436e5c2a610b8d2ccbb304039602dc3
SHA12de4420ca46bfd473c388c6d62b048a763c21c7d
SHA2564801f93d1904fe9e18c8314cb8780f8d97b378d70a0ab0612605beecf0d7ca83
SHA5124a5f15b8aa9631c40ab02499fb4971ca8a5262adf356a2751a64ee3f87120c1e89a408c3ea1c85c148a52d19e7ee66e3a64e004360c7b218fd8eca2d9e75e871
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1.6MB
MD547c6b45ff22b73caf40bb29392386ce3
SHA17e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9
SHA256cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0
SHA512c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331
-
Filesize
776KB
MD559c75eb33c157f0cffbcfa0758caa482
SHA10f8e77f0591f06f34bc3761db357a6df279665db
SHA256a7fe0553acc5302c379ee76b059ce4cc342411ce19bfb6ed6c84812190dedeb3
SHA5122210d053d0d67d6b7ca873aefe81404eb0a6b71165d900dcd7aed036f528cbb73cd3c45421a366a5e19308e18fb654f9568c03cc45946374e136e48c4c0046d5
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
780KB
MD5024e8ab13a5456834ebeb22d8e4ba83e
SHA150b185583b2b898afdfb5697ebe11ad647fb5323
SHA2561778c54ad9c420cb05de84ed040e2f286fe48b13504a2c0d373c5fd91f368358
SHA512ca60a5fb5423a006b9d8e4d8cad5497151af48b990aa6a90e737d1300d2aa7949e761afc350578ea41bb590c2dc1bc873f74ec0411ffc2756231ee01c0960ed4
-
Filesize
1KB
MD518d327dfbcc99443cb9151326ba03f00
SHA19526967283387e93efed0abecbcc9534632eed0b
SHA25695c7b17c51e0d2bfc7212f5bb9ed93019f32679489b26df4417917f05275de90
SHA512f17f86840a691296643be6c122fe68bb5e5537b7d68a3e579c1122fda9edbe6eefc856b9eee703973ee17b240d17f87f4add07f9f2ca952f51ba078d61169e00
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB