Analysis
-
max time kernel
70s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 21:57
General
-
Target
48ea1383f689277896530bfa764b94ad28d613fa038c3e418d0f53b4d9b30fa5.dll
-
Size
780KB
-
MD5
8af03012f1ac4220846c9fff35b62bfc
-
SHA1
689874bf9fceea26456670698904b4e29efaf6a1
-
SHA256
48ea1383f689277896530bfa764b94ad28d613fa038c3e418d0f53b4d9b30fa5
-
SHA512
6fe0e95d527709523be2099e2aab9ee2b6d82f1490451b4eda49b7bef3a85a8afb8fa543d334f2a7327e7e64809ca75cd2ea9713773c05bc9a979c4a354660b1
-
SSDEEP
12288:obP23onr2XV7KrPqgmNiQhDOy4/AT4r/E16K1QS/lsHAGHdDvRQ2sd1gqQw:obe42XV7KWgmjDR/T4a/Mdjm1
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Modifies registry class 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\48ea1383f689277896530bfa764b94ad28d613fa038c3e418d0f53b4d9b30fa5.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\BixnPjihE\slui.exeC:\Users\Admin\AppData\Local\BixnPjihE\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Users\Admin\AppData\Local\7Kj6\CloudNotifications.exeC:\Users\Admin\AppData\Local\7Kj6\CloudNotifications.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Users\Admin\AppData\Local\lgZ\AgentService.exeC:\Users\Admin\AppData\Local\lgZ\AgentService.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
784KB
MD5436f37f8b74df705847275325d794320
SHA161dcff39365c817ba561a109bd19e3dc19dc8062
SHA256e198da4af8e404a64b953d9f7c8bbd8661e538575654a481f2c7e9b5d41f7393
SHA51251ebe475baf044075a5fa367bcda3f9361c82953852a60e5ba3807536f544c133f88310440a488dfd363fd2c358a780fca392cdb469075e9346412585669f1eb
-
Filesize
784KB
MD5a252d1181e0b83679976ce38eea57628
SHA10bbed12e582e1c16b4ac750bd1157e6c601c4dec
SHA2561dfd2fdb701c2f1628a7a0673d865aa19a39dcd633e939b4274a421cdd79d56d
SHA5125044d89a2e28530bbd874af7b610eb6bcb7508d45c70989423b4c902de08314574b647ef473dda54266868a63f429c41016dac6abd3d0a6f30eba6801d3f418d
-
Filesize
534KB
MD5eb725ea35a13dc18eac46aa81e7f2841
SHA1c0b3304c970324952e18c4a51073e3bdec73440b
SHA25625e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff
SHA51239192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26
-
Filesize
1.2MB
MD5f8bac206def3e87ceb8ef3cb0fb5a194
SHA1a28ea816e7b5ca511da4576262a5887a75171276
SHA256c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268
SHA5128df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909
-
Filesize
780KB
MD50fc4f82be7c44993218495911355ef9b
SHA123d8dad415432b0a405c38e336e731045609927e
SHA256ad1f56cf294cc98fcbf62b4c6a9d70661d670c559910ef44ba796e3ae0d260f6
SHA512c978f40082ec28194a2f99e8720c81eb08e73f9bb8497464dd495af9ff259c9baecd8be4ad592b8499bcf5c5e47542c691d1b5a2d2114cb28171715dc9e26667
-
Filesize
758B
MD51518023fe56e8ae09fa36048e322846f
SHA195bf10047b550ed78b2b09ebe275b50b6d5a85e1
SHA256a49a87715680733bd79aaa3610f0b21eacef0dbf3ffc462bb62f5bbf21d877eb
SHA512ae8d05d04a6e6fbee2e6dc4e8f957441cce999ae1c28620e2eb80eab918b5dc46b100d987d302ca5330cd60d3469c51e226ae44f7152752ac771daf4201df5dd
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
784KB
-
Filesize
784KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
28KB