Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
25-01-2025 14:43
General
-
Target
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll
-
Size
984KB
-
MD5
89f99b617454ae1d26f9c5614f19fd30
-
SHA1
43194372fae7b50a95e00580ce5d64134e4c1b7d
-
SHA256
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277
-
SHA512
fb0445aba4301466b7c5d8dea9afbf87e0ab5d0bbbcee924d22af97700370f0dd13a80691ab322ffabbbb16e287df160344f5f7a54b1834be2b0fda0089470a3
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijg:1nuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\FXSCOVER.exeC:\Windows\system32\FXSCOVER.exe1⤵
-
C:\Users\Admin\AppData\Local\5ownx3\FXSCOVER.exeC:\Users\Admin\AppData\Local\5ownx3\FXSCOVER.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\OnG1ANi\sethc.exeC:\Users\Admin\AppData\Local\OnG1ANi\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MpSigStub.exeC:\Windows\system32\MpSigStub.exe1⤵
-
C:\Users\Admin\AppData\Local\uCdxw\MpSigStub.exeC:\Users\Admin\AppData\Local\uCdxw\MpSigStub.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD55e2c61be8e093dbfe7fc37585be42869
SHA1ed46cda4ece3ef187b0cf29ca843a6c6735af6c0
SHA2563d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121
SHA51290bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
264KB
MD52e6bd16aa62e5e95c7b256b10d637f8f
SHA1350be084477b1fe581af83ca79eb58d4defe260f
SHA256d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3
SHA5121f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542
-
Filesize
1KB
MD521593f791b1b57c8065ea7429a661081
SHA1a4b089b0873159cad8e2e146e2ad65e9ef935e67
SHA2569811d1d2dd53b803c1d3a0d65b919ef042f9690430d81af51c661ee70ddcf7ed
SHA512a36d65d7f7d926536d8aa8e4cb9c2e7d8ce9190fddcd26cc22d2bdb13b780af6dc9423471308db9798c783e7e3c87f5f4d47d40bb759125a0ac226420fe0d622
-
Filesize
1012KB
MD504a86763254bcfe50522822e44c93fe2
SHA1fd402ce19899fddc4cf555cb8e265c8827c59c63
SHA256beb539abf2aad9e6571520c50a75b8b2fec7393a697a7a73d738aa8058ea10b5
SHA512919bcbce5469fb8b35431fc6d0ebbeb7d5ce2f7b16063f6f40217a7f72359a7b6f45b4980dbe2f9bed0de00d41f9985ace9a05ceb939eadcd9156bd159d5c527
-
Filesize
988KB
MD5212bdfe01d6d5a805e12f40478bd3f58
SHA1616ee237178a66a19c5a8469564b4a825b2a9889
SHA2567b4e039120fb15016dd4f99dff99123f053cd2a32ef0733765846a6ff21a9b86
SHA51288b97d6df73bb339b6a6be9f3de9a66383408317a1960ceda0fcb880d20f1346937be848be2141e971ea357ac989f18090bf19afe08e633afc181c99ab7ba2a2
-
Filesize
984KB
MD5e9b2cb2436ecb7652b966552690f2a15
SHA125a185d49877280a413d81c86e109c55f516099d
SHA256ee4923f13d8730b909073e1efa9c657620fddd8949a812972ba07d327102b3ff
SHA512c02c322c89a0190e491ad561a2f2e6c89df0edff303cfcbaf4d81b5291441d5b53471e772e30914b99a576a1877b6ff7c5bf728c0be2e022e0f1b3edf4f42f67
-
Filesize
984KB
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB