Analysis
-
max time kernel
120s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
21-01-2025 02:29
General
-
Target
6c15387941d9c5100839fada2c08e23067b7467334e4ad6deb329d1660d4d482N.dll
-
Size
776KB
-
MD5
9b8172adb2e1a4edd396f5d9aab93030
-
SHA1
901c5cf6f637b2946fc11f7edbce9dabed6563ef
-
SHA256
6c15387941d9c5100839fada2c08e23067b7467334e4ad6deb329d1660d4d482
-
SHA512
69703121022941ff097b071d1458307f0b48395a2a58cfad191c2680f6f8c2e2c9322a30f5a441dbeb8daece5f02f2cffa3fe48f20d24ca7eebb41577fe995ae
-
SSDEEP
12288:fbP23onr2XO7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:fbe42XO7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6c15387941d9c5100839fada2c08e23067b7467334e4ad6deb329d1660d4d482N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mspaint.exeC:\Windows\system32\mspaint.exe1⤵
-
C:\Users\Admin\AppData\Local\5uzK\mspaint.exeC:\Users\Admin\AppData\Local\5uzK\mspaint.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\d4gjcYXIG\MusNotificationUx.exeC:\Users\Admin\AppData\Local\d4gjcYXIG\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\EhStorAuthn.exeC:\Windows\system32\EhStorAuthn.exe1⤵
-
C:\Users\Admin\AppData\Local\yaejrwii1\EhStorAuthn.exeC:\Users\Admin\AppData\Local\yaejrwii1\EhStorAuthn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD593ace1cdd8e045747eece69e2fc67f56
SHA13fa9d0debed0b57b6a0ed7211902158481a1e5e7
SHA2563ceae495c8f94cda4b2c243eaaaad8e849bc4a1d3e1fc6c0469c10be47a8e721
SHA5128300ff7c1f1076e31304ac4cf5a63b10e0c7d4fc864ffc1993f135150dc628c2ff476df1e8ace7f1fbb3c8a36f0dbb2e3e0665d92850cb2b1eb5a7a38e7705b8
-
Filesize
965KB
MD5f221a4ccafec690101c59f726c95b646
SHA12098e4b62eaab213cbee73ba40fe4f1b8901a782
SHA25694aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709
SHA5128e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
776KB
MD5ce29ed08c3540d3b35bb2a8d3b8fa799
SHA15bca70bb30da52f3729fd33f50f662f516b2f0c1
SHA2569673bbe2036d5b544c9da1fb5112a98a7479fa70f40780cc8cef4d861b12589d
SHA51245d9a1752e6f6c64b8a552d96b803e70ed25391093744fb0f77d049cd5daeb4d6ed829e651dd8efc3079fcf58e28a6fad8f1d8adab601ea3099b47f8f244892e
-
Filesize
128KB
MD5d45618e58303edb4268a6cca5ec99ecc
SHA11f8049fc5ea8b57bb68e19fb55cb9dc1e18e9513
SHA256d527323643be9df4d174c3169c6f2c7854a59b781654bcaebd154cb51fb4219c
SHA5125d7ae663dcfedfaf00836dc018131851e5a40778bd582b417b9f0bbd4bb6d1b2eb8f37f7f5a01cd2beed78b6037ef6eb2a3290248d5e901173b1407990a202bd
-
Filesize
780KB
MD517e4e63d2db4ee496992b5f259ac111e
SHA183237f153c531b68188609d32540da0e72fc4266
SHA2568d744d0ba2c6d1adae047ded650498bd302b60f1f41a1d20e873f6f48626e859
SHA51273fd0a2954de19b3d9e8d42aa19ffba5ce3ee1b371703f32b612b25e991c112c9fc851c7e4d0c39b5f88c3e5fef835fe1213a9bc3344b7e9bf5b7551818ba194
-
Filesize
1008B
MD5691465888c938c16b93cd43eded9a511
SHA141814d33c1d4c6c07d5b58ef02d76bd82238d26d
SHA25658d01d15d1a910d582808af2d7b4295698d5797af17adbde23ff46912778a804
SHA512bd69ce618878805c3a29c5b950e88bf98b8b3f4cc9449e1ac0c3f18a17f7f0c9d876f4b73689d7c61ba053e71eebf780c901a60e8e3e1255892c8631ed826086
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB