Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-01-2025 05:42
General
-
Target
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll
-
Size
984KB
-
MD5
f5e2ec95b6d3d591609351b2c32c15fc
-
SHA1
56ff4415603201d5367280e88348a56f24e4863b
-
SHA256
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff
-
SHA512
ccd2977e2a21ea3f8c0ca0774f84af450813a9b338dcf31e59ae377f7cca9206e64f7be2e756ead7abcc61114b7d1a20480bec7dca56e6252d264fbc824f6fc0
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijgx:1nuVMK6vx2RsIKNrjE
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\gnYM5\Dxpserver.exeC:\Users\Admin\AppData\Local\gnYM5\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\ProximityUxHost.exeC:\Windows\system32\ProximityUxHost.exe1⤵
-
C:\Users\Admin\AppData\Local\7KQ\ProximityUxHost.exeC:\Users\Admin\AppData\Local\7KQ\ProximityUxHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MusNotificationUx.exeC:\Windows\system32\MusNotificationUx.exe1⤵
-
C:\Users\Admin\AppData\Local\ww8sXT\MusNotificationUx.exeC:\Users\Admin\AppData\Local\ww8sXT\MusNotificationUx.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
263KB
MD59ea326415b83d77295c70a35feb75577
SHA1f8fc6a4f7f97b242f35066f61d305e278155b8a8
SHA256192bfde77bf280e48f92d1eceacdc7ec4bf31cda46f7d577c7d7c3ec3ac89d8f
SHA5122b1943600f97abcd18778101e33eac00c2bd360a3eff62fef65f668a084d8fa38c3bbdedfc6c2b7e8410aa7c9c3df2734705dc502b4754259121adc9198c3692
-
Filesize
992KB
MD58ca1e4e258414e16b59075d3bdf17efc
SHA111751d684b63cda7f3fe75eff76a89b97015f4d7
SHA25666a72c84d8dd5024adcac9ad676709d60180aeca2b7f7815b6044962f40829dc
SHA512aa3c506964e5e6caf0e33cd5ced04e3da7bee1debe2af6d9bc786573b40eff11577dbdfcb288287c1b217fd45be48d6ab2ae47baf76fbcd9343907a54e5478f4
-
Filesize
310KB
MD56344f1a7d50da5732c960e243c672165
SHA1b6d0236f79d4f988640a8445a5647aff5b5410f7
SHA256b1081651ac33610824e2088ff64d1655993dd3d6073af1e5ffe0b4a0027f502f
SHA51273f6fa01b880e6619fafa065c171bd0a2b7b2d908762b5aca15f2b8d856b5501b3884e3566ef9b8032c8cbf9bb15116e60c22fded4656c8857c974cda4213d65
-
Filesize
988KB
MD5f369cabc9dd1f498f06ad113a35c0dfb
SHA142c9458d8e346e28fc6069f7aee78ebf8382a9c7
SHA25603f794b9e9b58f913a514ff2ad588111ca38214417713a1f739214ff7cdb9983
SHA51210168b3634df41e2544e32336fd8a3efb772c0bafd6de02a12a37875f2b73be302281c5d96b0a7456992100bf0dec181121cef05d02053a7d57d2f4437a0ab96
-
Filesize
615KB
MD5869a214114a81712199f3de5d69d9aad
SHA1be973e4188eff0d53fdf0e9360106e8ad946d89f
SHA256405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361
SHA512befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012
-
Filesize
984KB
MD5d852259e936bf55d3db92816fcbfbecd
SHA184c6d9d3e1ed509ca223947f242aff2dfcda875a
SHA2567f1bc15d2167e01f6f8f2d2419719c77042cf7431077d7f4b2311783f886a028
SHA5127aa954bd1d85199077b918e0aa79699bf38669f018dd75f57150191f892d7a04d533f7b59743e80139a4658ade17faa30a309e047006f279edb63e041eb1a3bd
-
Filesize
1KB
MD585a01708b44b56053244c4675d7b09de
SHA1a09b9417f5e3ab0c30aaeae1ac3bbccfa69518e9
SHA2564ca3a105e69cf5ffe3f283342bea85d865efe37e6f86e39a6a404beb2d05caa5
SHA512192ae6868996c1b157c3cd846f6ef4e731f5c713d0e11e8cc18d3d343a0fa07ea59af872d3de326e5ddd915803e14bb0bb0b552edaa3c3d740ac96b880dd83e3
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
992KB
-
Filesize
28KB
-
Filesize
992KB