Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 05:42
General
-
Target
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll
-
Size
984KB
-
MD5
f5e2ec95b6d3d591609351b2c32c15fc
-
SHA1
56ff4415603201d5367280e88348a56f24e4863b
-
SHA256
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff
-
SHA512
ccd2977e2a21ea3f8c0ca0774f84af450813a9b338dcf31e59ae377f7cca9206e64f7be2e756ead7abcc61114b7d1a20480bec7dca56e6252d264fbc824f6fc0
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijgx:1nuVMK6vx2RsIKNrjE
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\isoburn.exeC:\Windows\system32\isoburn.exe1⤵
-
C:\Users\Admin\AppData\Local\yNhh6\isoburn.exeC:\Users\Admin\AppData\Local\yNhh6\isoburn.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BitLockerWizardElev.exeC:\Windows\system32\BitLockerWizardElev.exe1⤵
-
C:\Users\Admin\AppData\Local\0SN\BitLockerWizardElev.exeC:\Users\Admin\AppData\Local\0SN\BitLockerWizardElev.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sdclt.exeC:\Windows\system32\sdclt.exe1⤵
-
C:\Users\Admin\AppData\Local\lBEXYsPD\sdclt.exeC:\Users\Admin\AppData\Local\lBEXYsPD\sdclt.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD5e6dc31ab6ea8db55292729ab23501a8a
SHA104e92d637b89fc16761c46df096d48457a4d63bd
SHA25698c758cd6d6b911f3b9101bb235d71c9ab33e39fadbc62782c1940964a8670b6
SHA512a3a2a197d1a078866c96e23546938096673d4d6367dc4dcf45b0cfb4bc925676002ddbfbbf9f4ca2ceb572cf8d53e1e220ee772c86d6b8ff16156e1b6734f0a9
-
Filesize
988KB
MD521abb7983d7015b2e764a1c9ecd75e8f
SHA10d114e9c120e9b304f797f626bad5ce013f3d7ee
SHA256f6709a973aa07dc205ff117e3787189f4d326f3e6bb8a303f1026af2dc81759d
SHA51297dcf766b4dc5926fcde4f666245625428b6da2837da34d24682dfa5cbda77f41d65cbb0d94f3a0b06a05cf232a387e82b82f2bc66ee1179689468bbb981832b
-
Filesize
1003B
MD572551b5a5736edf01b488f1ab05aad99
SHA1ed7474c80c61a320545a32545fb75a7ce77f4400
SHA256f29e00946328ca93ba989fc1b02cefd8346abc60c32b99e663cb4a4e96555220
SHA5120d385f75644f15679d9f789d39ae7bc07d9576f4d9889f0a70e71882619e6eb7965183262ac764f359b8789d72f32db2a4633acdf89f56f033baa9a68b4768cc
-
Filesize
98KB
MD573f13d791e36d3486743244f16875239
SHA1ed5ec55dbc6b3bda505f0a4c699c257c90c02020
SHA2562483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8
SHA512911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af
-
Filesize
1.2MB
MD5cdebd55ffbda3889aa2a8ce52b9dc097
SHA14b3cbfff5e57fa0cb058e93e445e3851063646cf
SHA25661bd24487c389fc2b939ce000721677cc173bde0edcafccff81069bbd9987bfd
SHA5122af69742e90d3478ae0a770b2630bfdc469077311c1f755f941825399b9a411e3d8d124126f59b01049456cddc01b237a3114847f1fe53f9e7d1a97e4ba36f13
-
Filesize
988KB
MD512ca35a4d2a88b64bf77c488709ea95b
SHA1d67b6086f51e2c76146cfffa6e1baff601b8a80b
SHA256d16296d549394c9c783b14db76e7b92384a97e9714582c853e80eb9e054a1c00
SHA512497a0b5b71d01c06de282b4c161781e3b2f584cb6630929a4aded5fddc680b61ee9adebee2554f7d03de48a3a1bd9428c87c643cfe44bb94f5791f724e1821df
-
Filesize
89KB
MD5f8051f06e1c4aa3f2efe4402af5919b1
SHA1bbcf3711501dfb22b04b1a6f356d95a6d5998790
SHA25650dcb4be409f50d26c0fc32dd9cdbf96bff4e19bf624221cb566ebeb3e09ce1a
SHA5125f664d937abe4426ee7e0d8491a395f9ef4ffe7a51dba05b54b7ba27e80c9be37833400911c5878d3dec659f4fa1579ec8ba4cfc485fb2ce24dd37c321006daa
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB