Analysis
-
max time kernel
120s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
25-01-2025 14:43
General
-
Target
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll
-
Size
984KB
-
MD5
89f99b617454ae1d26f9c5614f19fd30
-
SHA1
43194372fae7b50a95e00580ce5d64134e4c1b7d
-
SHA256
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277
-
SHA512
fb0445aba4301466b7c5d8dea9afbf87e0ab5d0bbbcee924d22af97700370f0dd13a80691ab322ffabbbb16e287df160344f5f7a54b1834be2b0fda0089470a3
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijg:1nuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\LF7PC\mmc.exeC:\Users\Admin\AppData\Local\LF7PC\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Magnify.exeC:\Windows\system32\Magnify.exe1⤵
-
C:\Users\Admin\AppData\Local\zkQQjbnzj\Magnify.exeC:\Users\Admin\AppData\Local\zkQQjbnzj\Magnify.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\msdt.exeC:\Windows\system32\msdt.exe1⤵
-
C:\Users\Admin\AppData\Local\Z3oVws\msdt.exeC:\Users\Admin\AppData\Local\Z3oVws\msdt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD58cf2d12f6e31c12a78fe09d7b9ce1f68
SHA1bad18d11a5a10e680c3ac39eb774862f93907f2b
SHA2567dd37ef1b8f75bb0671ec4abb8fbce312188acecab79d9b7819e5a9042a32089
SHA512b1a77879de76089e0f5496a7a5ff94b7ebbe13867b19a78d7a27d21116ddbf763da859f350fd7487e179d46369a006551ce8b0401a566eab2a37ee246d97aa35
-
Filesize
1.8MB
MD58c86b80518406f14a4952d67185032d6
SHA19269f1fbcf65fefbc88a2e239519c21efe0f6ba5
SHA256895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a
SHA5121bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099
-
Filesize
992KB
MD5baa46ce655868134a9ac10c868b5d01d
SHA1d08a936517bb4922d3b84bd57ced1659b30781f2
SHA256f97259c071dad0340dad5cbc51420fd6ff60285852cf15881452f382ea5d6178
SHA5123e4bf23b98a7d97c3aa85553547520a3e95fac1a14299b15be7e18f9d9c058c7be7e2f8ad90e80a96b25e4ad79619010ee26d942daa5500a45ba29f35c33eed2
-
Filesize
421KB
MD5992c3f0cc8180f2f51156671e027ae75
SHA1942ec8c2ccfcacd75a1cd86cbe8873aee5115e29
SHA2566859d1b5d1beaa2985b298f3fcee67f0aac747687a9dec2b4376585e99e9756f
SHA5121f1b8d39e29274cfc87a9ef1510adb9c530086a421c121523376731c8933c6e234e9146310d3767ce888a8dce7a5713221f4d25e5b7b6398d06ae2be2b99eadf
-
Filesize
639KB
MD54029890c147e3b4c6f41dfb5f9834d42
SHA110d08b3f6dabe8171ca2dd52e5737e3402951c75
SHA25657137f784594793dc0669042ccd3a71ddbfedeb77da6d97173d82613e08add4d
SHA512dbdc60f8692f13c23dbed0b76e9c6758a5b413bd6aaf4e4d0ba74e69c0871eb759da95c3f85a31d972388b545dcf3bb8abbcbedd29a1e7e48c065130b98b893d
-
Filesize
988KB
MD5a2f276c0d30263d532aed94a849a9357
SHA1ebef68c77f5dd2081b07760da1a9ce7a0a550aa7
SHA256a20d4a162aa6076321be8eef891a0db8c06afcf839867b4fe662a35f9d4a32f4
SHA51219187ed9d12fc0e2daa858f6fe8c9e7b4762ba349c18fde85c82ac24d6faff27174d042bc188b94a470a5238e7fcce08b21206bf440706f0108cf5ba4203eaef
-
Filesize
1KB
MD5073523a2f00e7cfc5774ed3bd8cb2dce
SHA1945b5469fae6fe4cd36395c4256cf665de2fee2d
SHA256d4daabc3419b840a6a6893910571aa7af9d8f0f88bca03d813a17f156d771f08
SHA512d2febc50bbad7271017aefa230ed33177fbc8c0533a963215152353ae13747a5072942682bccc7b7c6ea4e725dd84aaeefc205cbc558783798d3fed533c44737
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
992KB
-
Filesize
992KB