Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
26-01-2025 00:22
General
-
Target
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll
-
Size
984KB
-
MD5
89f99b617454ae1d26f9c5614f19fd30
-
SHA1
43194372fae7b50a95e00580ce5d64134e4c1b7d
-
SHA256
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277
-
SHA512
fb0445aba4301466b7c5d8dea9afbf87e0ab5d0bbbcee924d22af97700370f0dd13a80691ab322ffabbbb16e287df160344f5f7a54b1834be2b0fda0089470a3
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijg:1nuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\AKDRZD\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\AKDRZD\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\jOT\PresentationHost.exeC:\Users\Admin\AppData\Local\jOT\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SnippingTool.exeC:\Windows\system32\SnippingTool.exe1⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Users\Admin\AppData\Local\7CzSDj\SnippingTool.exeC:\Users\Admin\AppData\Local\7CzSDj\SnippingTool.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- System Network Configuration Discovery: Internet Connection Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5f06d69f2fdd4d6a4e16f55769b7dccc1
SHA1735eb9b032d924b59a8767b9d49bdb88bed05220
SHA25683be001996cd4d9e5a1a8cd130e17e5b5ee81c9b5cf1b9d9196d8a39fbf7506d
SHA512ccc1bff59636e91763659749d67b9f6255765ed5aed4b40b6f8111d4136a7e2fe9e0726396b0c837e4ab8717528134273ffc0825a205e501a13bf1d3aee5046b
-
Filesize
988KB
MD52f19cadad4dd966bcac0a916d99bc823
SHA12d9b5016c395d495635a9070072c6adb96883131
SHA2562b9184cae7c13e8e68ef254de24aa26908e7eb0c6cfa1dcaa5fbfa187c7f7c05
SHA5124f5a686db5119d9a17e3f8fb509c772a0fd9e8428894be0d4ddccd87fd9ef3fb6625719905fd2adb7422d7ae731ab71620fb23588af29cd3a00bfbb2baf97b56
-
Filesize
984KB
MD528fc0ad73a687b601b8bcb480b63a7ba
SHA1680eb0e7265c5dc6e37e08dd7e416eb93dd3efb3
SHA25692e42a103837b6c415cd20c6e9eed8cf058b6d0a3cef5bad557d1853d702f758
SHA5120889512f3a1773f02c3066d3b53774cee774051d9fff09fb15f66d20b0ba06bb14da89fb197de81c71dfcc26bd5cef924884d35b94fab2fcb9bc6eba74a8ab7b
-
Filesize
82KB
MD5de58532954c2704f2b2309ffc320651d
SHA10a9fc98f4d47dccb0b231edf9a63309314f68e3b
SHA2561f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3
SHA512d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
984KB
MD5d44abc6d40c8d87131181dff700f1061
SHA11c30334f4c7d982d79a0b54c57c3ef30da5da294
SHA2566cd43980574b8df22b98c377965b6ea8b64fb65f8e1e13992583fd7f5d959874
SHA5124d73753ecfeef093d514b9b5edc9c804891f5c5103af1a013f9e2cec19ca29a480eae43648071da1c5411944710650838ad3c5f7e4e4553f6f76f10ea12120ef
-
Filesize
1KB
MD5359c4dc9bf5c3daa71875268f82db728
SHA1cfc76a0da41ec95515a1472d788464a875f677cc
SHA2568dbe653d61bd4a4a76f431c8ad0b6f37bd333cffb17c7cfcc0ae76fbfe3249f9
SHA512a469279ab65f62ed323718b1399d70197104c0de47fd1647d8174bcaced9388307e06abd8e296241708acc91206f26c4e28580491c788a7997f3953668642523
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB