Analysis
-
max time kernel
149s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
28-01-2025 06:04
General
-
Target
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll
-
Size
984KB
-
MD5
f5e2ec95b6d3d591609351b2c32c15fc
-
SHA1
56ff4415603201d5367280e88348a56f24e4863b
-
SHA256
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff
-
SHA512
ccd2977e2a21ea3f8c0ca0774f84af450813a9b338dcf31e59ae377f7cca9206e64f7be2e756ead7abcc61114b7d1a20480bec7dca56e6252d264fbc824f6fc0
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijgx:1nuVMK6vx2RsIKNrjE
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wermgr.exeC:\Windows\system32\wermgr.exe1⤵
-
C:\Users\Admin\AppData\Local\3Cx\wermgr.exeC:\Users\Admin\AppData\Local\3Cx\wermgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\M1fVyLtZ\osk.exeC:\Users\Admin\AppData\Local\M1fVyLtZ\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Users\Admin\AppData\Local\ZxZ\Netplwiz.exeC:\Users\Admin\AppData\Local\ZxZ\Netplwiz.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD541df7355a5a907e2c1d7804ec028965d
SHA1453263d230c6317eb4a2eb3aceeec1bbcf5e153d
SHA256207bfec939e7c017c4704ba76172ee2c954f485ba593bc1bc8c7666e78251861
SHA51259c9d69d3942543af4f387137226516adec1a4304bd5696c6c1d338f9e5f40d136450907351cce018563df1358e06a792005167f5c08c689df32d809c4cebdcf
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
26KB
MD5e43ec3c800d4c0716613392e81fba1d9
SHA137de6a235e978ecf3bb0fc2c864016c5b0134348
SHA256636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c
SHA512176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08
-
Filesize
1KB
MD5478f89fd7027e64c1b4908a0cf3c5186
SHA1bc7848bfa2111b78efd7581e9ae1e503d949fe5f
SHA256fe4e6fc2308e71dbeef090c0c08c2d0475b410d2318da67f0ac6a667bceabbc1
SHA512bc19dd6ffdab5e720bb152bf775105999a0feed022d29540ba75003aef7e655b4942d82e1f82ea8b4d995df3a5ad66b02ca686f4d8052db96656cc905284e8c7
-
Filesize
988KB
MD5951a31a9d7f2385e20536e5a73abd098
SHA145e3704c5ca2c64d3a19e753bf2f65d7cd14e214
SHA2567edf6a92e9ec0bb6b7153b8a9d76b86d0ddaa613a9b848fdc92cd6f00770a06a
SHA512be642465a29af9b81daee57bb739f43dad4341fb0ab34eb5a7b7b274d021841d1a7350d350824d9d69cec8b5fb3cbde922911c4919de90d469e63e17bafd19b5
-
Filesize
988KB
MD5bff40eaf2af07e6d3ee6be46c65ff782
SHA18f7c1a156ad1e175d88fa0b2380abe68a5dfd8db
SHA256bfefca53eeaa707cad031b7f3f72ef28154051d82e8cfb97d08b5f224c47d2ba
SHA512bcd610a583d9d2fba6d947f47110e11b30999ccc84cde294f7251042777d3127bcc56b102eb9edf4174ab73be437ed863c69f55e8dd8315d57dbeaad3d112da9
-
Filesize
984KB
MD55e8fb406d92709ae899ae48bd1b74980
SHA1f633644874ffa12894c3c3551728187d903b0bd1
SHA256ca7e9d050685735acbd375528bf579ac9f5d1956d8f967e85cf125fceed294b3
SHA512c81a6fd695b75a5492365b457371842d065504c14f0a0893f9758c96ba4e8bc155827e303a69121447b631ae0ca1aed5cc2a9f25587e3f68f36ba50bf3557820
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
988KB