Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
26-01-2025 00:22
General
-
Target
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll
-
Size
984KB
-
MD5
89f99b617454ae1d26f9c5614f19fd30
-
SHA1
43194372fae7b50a95e00580ce5d64134e4c1b7d
-
SHA256
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277
-
SHA512
fb0445aba4301466b7c5d8dea9afbf87e0ab5d0bbbcee924d22af97700370f0dd13a80691ab322ffabbbb16e287df160344f5f7a54b1834be2b0fda0089470a3
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijg:1nuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵
-
C:\Users\Admin\AppData\Local\uLESwCEUe\lpksetup.exeC:\Users\Admin\AppData\Local\uLESwCEUe\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mstsc.exeC:\Windows\system32\mstsc.exe1⤵
-
C:\Users\Admin\AppData\Local\8gPHWVs\mstsc.exeC:\Users\Admin\AppData\Local\8gPHWVs\mstsc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdrleakdiag.exeC:\Windows\system32\rdrleakdiag.exe1⤵
-
C:\Users\Admin\AppData\Local\pUY\rdrleakdiag.exeC:\Users\Admin\AppData\Local\pUY\rdrleakdiag.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
MD5f9d538b6e820c37fc1a397ce39256d97
SHA19cfae9ddc093e896c789dda2de71a3cae0cabc51
SHA25627863fbd39b69b0bd6e334f9bb364bbfb3bcef5dc8c47c4bc89b1e9d2ad5082b
SHA512457fe0d9f38232340dbf80592a50680297d20d76dd467e81ef83b0e287b81fadf0ffec27991f21fe62b817e09185ba88e2bc4f0d7837e0c565f73555e9143c73
-
Filesize
984KB
MD5097b143f0e851dbce77c29ea74f0fdbf
SHA123fde08cdd91c71c03de2be0c250f18988570e9d
SHA256269fdf61bfdf2509ecc9e4285b8f02333c061de564801688dad7e6150dc2cd7b
SHA512f0406f1e01b5562078cd2c6e96576b58a411319ea5c631be4e6ec14757f89f5c4b38b4be9c2d2f73646f3a7f0eb11a1557e185afa84f27fdd7f591cb11c02c33
-
Filesize
1KB
MD5d8ece32817e0d44addafad516f1f048e
SHA10c39afc7464d463d4a8a9fe7450c4420ee57217b
SHA25643f963831812cf00ce239b086a591d3589edd19f7e5f85f2970d3446424e918d
SHA512f80d260309a274ac191735b081eeb15105f24ec4f4d5cca243ffc59c43376b81ba6ceb5d4cd33717461833df9c6044b4d33db3c6ff7ea403fba3ac764052a61d
-
Filesize
988KB
MD510691a4b5a5392ccf4aa7cd1bc38aa46
SHA1a774d346f04458a7b01a9f2afa523da708b4738c
SHA256563af9f8f73e662d924ca9826dc571d415bf5c0558a2c02981c30a71ea982840
SHA51289c5a35dd6905c114988b7b1b394738b3be8b43104e80fca63692d92b4a4a654acb23bf0eb596fa42ba3dca4e612c7454bb5063060e5b3e59cc69d07f0304f95
-
Filesize
1.1MB
MD550f739538ef014b2e7ec59431749d838
SHA1b439762b8efe8cfb977e7374c11a7e4d8ed05eb3
SHA25685c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3
SHA51202e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8
-
Filesize
39KB
MD55e058566af53848541fa23fba4bb5b81
SHA1769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6
SHA256ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409
SHA512352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0
-
Filesize
638KB
MD550d28f3f8b7c17056520c80a29efe17c
SHA11b1e62be0a0bdc9aec2e91842c35381297d8f01e
SHA25671613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f
SHA51292bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB