Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
28-01-2025 06:04
General
-
Target
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll
-
Size
984KB
-
MD5
f5e2ec95b6d3d591609351b2c32c15fc
-
SHA1
56ff4415603201d5367280e88348a56f24e4863b
-
SHA256
123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff
-
SHA512
ccd2977e2a21ea3f8c0ca0774f84af450813a9b338dcf31e59ae377f7cca9206e64f7be2e756ead7abcc61114b7d1a20480bec7dca56e6252d264fbc824f6fc0
-
SSDEEP
24576:yWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ijgx:1nuVMK6vx2RsIKNrjE
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\123a833c6ad4fefb0e612a93c8bfb2fda9525414b308f18c9d3ea56a5ea37fff.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CameraSettingsUIHost.exeC:\Windows\system32\CameraSettingsUIHost.exe1⤵
-
C:\Users\Admin\AppData\Local\tdioC4m\CameraSettingsUIHost.exeC:\Users\Admin\AppData\Local\tdioC4m\CameraSettingsUIHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\Taskmgr.exeC:\Windows\system32\Taskmgr.exe1⤵
-
C:\Users\Admin\AppData\Local\XOCiIdhZ\Taskmgr.exeC:\Users\Admin\AppData\Local\XOCiIdhZ\Taskmgr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\DevicePairingWizard.exeC:\Windows\system32\DevicePairingWizard.exe1⤵
-
C:\Users\Admin\AppData\Local\OiubIr\DevicePairingWizard.exeC:\Users\Admin\AppData\Local\OiubIr\DevicePairingWizard.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5d0e40a5a0c7dad2d6e5040d7fbc37533
SHA1b0eabbd37a97a1abcd90bd56394f5c45585699eb
SHA2562adaf3a5d3fde149626e3fef0e943c7029a135c04688acf357b2d8d04c81981b
SHA5121191c2efcadd53b74d085612025c44b6cd54dd69493632950e30ada650d5ed79e3468c138f389cd3bc21ea103059a63eb38d9d919a62d932a38830c93f57731f
-
Filesize
1012KB
MD579fe7843bb1660add317762566185a67
SHA17d1dd71ed84f970b38a069df38d9860663da15fb
SHA25650892d4c945dd8fdb92f96e4caeb41eb7434c0fac0c1815622073df1b45dfbe8
SHA512370398d5d178adfb519e29dcf0a6b1349fc4bf7d4dedba6d7f851da3be2364b1eba0c554d39f019d98ac7b53655b1c7fb301358882702a6aebdd26eeb0400fe9
-
Filesize
1.2MB
MD5ec1915292bb5600f0f00bec9789369fa
SHA186593ea88f530a1ed87aa73b143af4d83a4c148c
SHA25618383f3aa0c018d1e949233f7cf5d60d3865176b968abc30080e903876c1acd6
SHA5121079dc8d429f16983aee8343968db843f23ee0a4d98ef8809171c66edc7c16bee49e41a7f77d262ba070f4707c3b927999f57e842d2236c68a45e14f50d0d599
-
Filesize
1.2MB
MD558d5bc7895f7f32ee308e34f06f25dd5
SHA17a7f5e991ddeaf73e15a0fdcb5c999c0248a2fa4
SHA2564e305198f15bafd5728b5fb8e7ff48d9f312399c744ecfea0ecac79d93c5e478
SHA512872c84c92b0e4050ae4a4137330ec3cda30008fd15d6413bf7a913c03a021ad41b6131e5a7356b374ced98d37ae207147ebefd93893560dc15c3e9875f93f7a9
-
Filesize
31KB
MD59e98636523a653c7a648f37be229cf69
SHA1bd4da030e7cf4d55b7c644dfacd26b152e6a14c4
SHA2563bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717
SHA51241966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78
-
Filesize
1.2MB
MD5d923d2c51e28d8b4db431e57f0c48d77
SHA134f24a73bb8672dc3d6318e52e413cd7130e8374
SHA256fcc450a3ead2b31fd51d98a598548e25dadedce7b46ada8df1b6ba6b09566fb8
SHA512ecc38ce284dcdde475504b2aa5f4eabdc2f34f53071c10173e26faed21dee235a4c796924d0e6e15766c0f5b44eaaab8d6e46122c24d76c1dad6d6d64ed16ce3
-
Filesize
1KB
MD553b1e1a93dbf6ff0c90ea9fd15cd67bb
SHA1f6fe536f15ebef3da5b5573b7e189f9a27032e5f
SHA2564f026d148517fe31d3386610da2cd10a54e29771927b5917bf3db9e86ce85456
SHA5127e0a59bae8340b61542528f700a6878f50c062632b9073a9df4943740dc15bef01c58f60bc05e34f6ed38d3f6570009f26db1ee1e4a42c2be3710ab30f3d2f9c
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
1012KB
-
Filesize
1012KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
28KB
-
Filesize
1.2MB