Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
23/01/2025, 01:55
General
-
Target
6d29b1ddb14e42725ac1351da325c2a612a917dd6c455e88733febba2d8e64c8.dll
-
Size
776KB
-
MD5
2a9f5f71552637fc95139e9ae638d5e5
-
SHA1
36de00ab1abbd4af62c3a3d1d9f88c50622d8a87
-
SHA256
6d29b1ddb14e42725ac1351da325c2a612a917dd6c455e88733febba2d8e64c8
-
SHA512
82154505cdd05eee12a7a31b49c0d6b2457d6a2a7b962e2b907830ad7d4ab5260dc96f5a0f6178ea60745506ad5fafe1ab8b1a087f21f9395c2bcc222166ae8b
-
SSDEEP
12288:bbP23onr2Xi7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQ:bbe42Xi7KWgmjDR/T4a/Mdjm
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\6d29b1ddb14e42725ac1351da325c2a612a917dd6c455e88733febba2d8e64c8.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\LO5a\rdpinit.exeC:\Users\Admin\AppData\Local\LO5a\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\bxzu5xY2\Dxpserver.exeC:\Users\Admin\AppData\Local\bxzu5xY2\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Users\Admin\AppData\Local\TxLi\tcmsetup.exeC:\Users\Admin\AppData\Local\TxLi\tcmsetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
780KB
MD542c175a1b98f5f4faef1e8e726b1959b
SHA13be7540fb2c6f41a87c9ce9c8a7a567513af819b
SHA256ce07bf632e26e425261300879ba4d54a47b6b16a5ed9faf1d9264dfd588b9cd7
SHA51274cd73fe9edd178ed4acd76e034b4bc65828c3de193af40a46984a14404f3c96fc1e04a2bcf34b03ecd7412636e1a27070606c49780c5d3cdd38c89451fe6191
-
Filesize
343KB
MD5b0ecd76d99c5f5134aeb52460add6f80
SHA151462078092c9d6b7fa2b9544ffe0a49eb258106
SHA25651251863097f7c80ef59606152ec59e7522881c8e3886c194c43f56bcab92e1b
SHA51216855c7db48b26297c78d37d52ad03f6af0f5a58e333e17ad83b34f5e8b200c5517c6481043af0ecf1b962af2378f38600bd968592f4e1018b5a1b9400adb367
-
Filesize
784KB
MD5188fa8b56f797aa74d6f3637f0a43434
SHA1e083e4208f6b7b8f5588981f8d8e846edfec875f
SHA2568d6b6509d49f0c892d2bf63c263819a3cffbc25600168497a4fa99ec4b54fb10
SHA51278fbb9a20077031a1d7db7a71c37b433f0f04aee8d53c58c6e6e9cbcec9e8b10739495ce15ad8869b62d4586a4f729a057b16d21c1856912003706e228188f2f
-
Filesize
16KB
MD558f3b915b9ae7d63431772c2616b0945
SHA16346e837da3b0f551becb7cac6d160e3063696e9
SHA256e243501ba2ef7a6f04f51410bb916faffe0ec23450a4d030ce6bfe747e544b39
SHA5127b09192af460c502d1a94989a0d06191c8c7a058ce3a4541e3f45960a1e12529d0cdaff9da3d5bacfdceed57aeb6dc9a159c6c0a95675c438f99bf7e418c6dc5
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
780KB
MD594ab0c793924d07458bea087af9cb04c
SHA1055ab9ca5de2d0edce2c670fe7b4bdd7acf2e884
SHA256c92ebe60e9d68bef834ca52d32534c587ceafeb68c38f1cc750728401e6fa544
SHA512cab911e452b64974447b94a291e47ca781b4b057bc28c541a1fae303fc76755cefa1ab239a53f18bea8eb422c65245eef8b5f68a511b26669e6bbbc4f99fe4d1
-
Filesize
1KB
MD51ac0693bd319d23caf98cc1fc290134e
SHA112483149e537368099607f2c5b47956d559bccc8
SHA2561b6fd36eb88bc16af28e45dd27ffcc39dbfc67af323151de7f4bc8ee250c6d68
SHA51204b78bb077c32ef5dca0e06d3da7c478ac50ada642dbb63158c300420b1e64248119793c85b1cdac824cd305e388457cc99cdfc57bc53b8e9c9ea0d7479bb855
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
64KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB
-
Filesize
784KB