Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
17-02-2025 07:38
General
-
Target
e39f3bcdcae4e78e73305f92a83fb3b4e438ccd669c1692321271d0a8d70d607.dll
-
Size
776KB
-
MD5
57625062489581e062e1dcfcf2e6dddc
-
SHA1
e04d7fdf4a710f91205a0aff59b5da2196c65154
-
SHA256
e39f3bcdcae4e78e73305f92a83fb3b4e438ccd669c1692321271d0a8d70d607
-
SHA512
c9f08913371c44ca7b5173d4522a219ab3e974e326051a2c953ade08e9a031fb2afae99ba506dd304d8b5fe2c1f082317f0dfd93d68a7cd8e155c415fd2bb250
-
SSDEEP
12288:NGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7Lt:w3JAvRl/fKQKCgFfx4P/vaLt
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 5 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\e39f3bcdcae4e78e73305f92a83fb3b4e438ccd669c1692321271d0a8d70d607.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\winlogon.exeC:\Windows\system32\winlogon.exe1⤵
-
C:\Users\Admin\AppData\Local\G84ICIx\winlogon.exeC:\Users\Admin\AppData\Local\G84ICIx\winlogon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\dialer.exeC:\Windows\system32\dialer.exe1⤵
-
C:\Users\Admin\AppData\Local\krA\dialer.exeC:\Users\Admin\AppData\Local\krA\dialer.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵
-
C:\Users\Admin\AppData\Local\DvD\calc.exeC:\Users\Admin\AppData\Local\DvD\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
784KB
MD57fb0f6125484d66ba6cb6f02c06eda8f
SHA1dc1d6d7b0edadf0b830d4664cfba911b4baf2a1f
SHA2561778d351feb4020399de15a7bcadd7c426dc45a78840eb14b37f3606c9a273d4
SHA512474e3e8e82d3c124f8b7b57bb4abc1a0784114c7854250e8bc22b4005cf9de065781f98e69c69dc3791e4c31a96106d19c66d43cc0d0e70fe18e4c55f0ea440c
-
Filesize
784KB
MD57879ce704c17bca116bbba6faa67ac07
SHA1fecbfacee0aff5f2fd578b940458072116ae735c
SHA256270e229def6ebb0b9b49a97688e151cae19fd46174d489340f76b62f745e7447
SHA5129db1319ee25c638b63a45ad4f9a35198970f9bcc565bbf99b739bb9a7119d2832f5dd042bcdd34944b4bdd0dcd24c5f1ba5d71925855138ace09eefc44e202ed
-
Filesize
1KB
MD52f1209776fb4e4d060520fbf86509c91
SHA182d9afdac6f87ce6da8fb630a58faef47f46c69b
SHA256c9fe6dbdba752e649a598dbc3b865d5be9ecd465e4d46767e3147ed2c365b43a
SHA512939a6012d2e7564151c23f6a064418eca8fd4996ea20f53aa9eec862eb1065a8cee5d99b0785415e7a9b650fcd02fc773aa14a2a5e16058bfa4172639a221237
-
Filesize
780KB
MD54021d7b80ca213311fb27094e46251fe
SHA1c8d03bbad8994f96f4a0c02c2ea980b6c06e9b23
SHA256a202cd009c48f0f03d4a9587fd122a95848158c9ce46ab15dd21a97707a977e3
SHA51217389eb96513e3f0fdaf1a15c17f057a4bcc4a6ca1a0bcfa68b3d36c79ea937c858227f25efffcc9b517eb2b80d2fcda559a3788dcf6317523e691ebeb9aa345
-
Filesize
897KB
MD510e4a1d2132ccb5c6759f038cdb6f3c9
SHA142d36eeb2140441b48287b7cd30b38105986d68f
SHA256c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b
SHA5129bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d
-
Filesize
381KB
MD51151b1baa6f350b1db6598e0fea7c457
SHA1434856b834baf163c5ea4d26434eeae775a507fb
SHA256b1506e0a7e826eff0f5252ef5026070c46e2235438403a9a24d73ee69c0b8a49
SHA512df728d06238da1dece96f8b8d67a2423ed4dcb344b42d5958768d23bd570a79e7189e7c5ba783c1628fe8ddd1deaebeacb1b471c59c8a7c9beb21b4f1eb9edab
-
Filesize
34KB
MD546523e17ee0f6837746924eda7e9bac9
SHA1d6b2a9cc6bd3588fa9804ada5197afda6a9e034b
SHA25623d8a6a1d847a324c556c30e10c8f63c2004aeb42ac3f5a5ca362077f1517382
SHA512c7117c3778650864e685bd89df599d7cdd9319d757344ddc7cfd9403d6673964127f6ff0c5ac48455fd3097af31a6ff09173f85dfa7be2d25f395cdf3692bb9a
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
776KB
-
Filesize
776KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
28KB