Analysis
-
max time kernel
149s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
-
submitted
27-01-2025 12:58
General
-
Target
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277.dll
-
Size
984KB
-
MD5
89f99b617454ae1d26f9c5614f19fd30
-
SHA1
43194372fae7b50a95e00580ce5d64134e4c1b7d
-
SHA256
138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277
-
SHA512
fb0445aba4301466b7c5d8dea9afbf87e0ab5d0bbbcee924d22af97700370f0dd13a80691ab322ffabbbb16e287df160344f5f7a54b1834be2b0fda0089470a3
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijg:1nuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\138cd54735f5ce4b638c5bb68c9e0bf5776cf81d776e46592ef10a9bc58b0277.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\9lNBTl7\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\9lNBTl7\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\9WYg4j\PresentationHost.exeC:\Users\Admin\AppData\Local\9WYg4j\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\OHOImJ\raserver.exeC:\Users\Admin\AppData\Local\OHOImJ\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD5ef27d65b92d89e8175e6751a57ed9d93
SHA17279b58e711b459434f047e9098f9131391c3778
SHA25617d6dcfaced6873a4ac0361ff14f48313f270ac9c465e9f02b5c12b5a5274c48
SHA51240f46c3a131bb0388b8a3f7aee422936f6e2aa8d2cda547c43c4e7979c163d06c5aa20033a5156d3eeee5d455eeb929cbce89bcc8bb1766cbb65d7f03dd23e2e
-
Filesize
984KB
MD5dd84fcb6687d4fb83a63b4e6e961549d
SHA13f2bf9852ef96fa25911f2ca94d600e1771ae881
SHA2568210fc1cbe6b90651ff873e7b294b12fd0fcc0bbcd49ddd675aa855c9a6cee4e
SHA512ee0bacfba1d3cb5ca806d9683ad02c75cc45cc77bc408594a2eee0361c1804cf409d0f6e9ae8954d33c96893252b937f215edf037f0efc7a6f41d800df34f937
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.2MB
MD57fd0536632d926cb1cdd8dd97e45dda3
SHA175ac0766b4df3e9d5e467174a39764b9d47a5265
SHA256bef36185b470202d3d9432cda413c72638d755fea11c131aa8bf22d99dbd6bda
SHA51245bdb0f5d6d58a598745ef40b078849dbc86ba89c968129dc413c2dcc31258a76e6078651c5c21391b9a650ade04dc463e87e738e606cedfab7abae9c466552a
-
Filesize
988KB
MD5a5a5ef38fb5537960707f8fc3baf3e9f
SHA120b7876e086d6cf70fb280d972ab8b544742aabb
SHA25646526946fc0f68bb5f0cf6594631d6191d6b5742ad9fc11554b4a6926883237a
SHA5126562097f4ee1134571b0ca96cac7b016ab132fbf53eb9f1032b61fe22ba0bc48dc323bb90d137b016bdffee3b3f0173e8c9c2017191e5ec1ffa48780d9de683c
-
Filesize
132KB
MD5d1841c6ee4ea45794ced131d4b68b60e
SHA14be6d2116060d7c723ac2d0b5504efe23198ea01
SHA25638732626242988cc5b8f97fe8d3b030d483046ef66ea90d7ea3607f1adc0600d
SHA512d8bad215872c5956c6e8acac1cd3ad19b85f72b224b068fb71cfd1493705bc7d3390853ba923a1aa461140294f8793247df018484a378e4f026c2a12cb3fa5c9
-
Filesize
1KB
MD572e1d06d28846abfde8095dac3fe7ab0
SHA115e700c469faf5e7084dd8cc79e2d789284a6902
SHA25683c4020e2ef478c47c77b9451ca6e000c0a86e9f51fc62151ecec12ba3fb811c
SHA512fd6bc7f9afefc5186b42ddeea4551c5ea4866440e35603bdd22f4c0231d00eed1d4812c1313d7c6fd760a35e24ead1fa40c2f389a61cc58313f3be909f9d9763
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB