Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 10:58
General
-
Target
afa9c41340915e052915ffb037526bfed01e8d7befc8767f4bb8e0fa628365d9N.dll
-
Size
780KB
-
MD5
3caa124004a7de62cdbcb2c165e57610
-
SHA1
9e023d9ad84bc5fe1dee5399d4f7772bf11cae61
-
SHA256
afa9c41340915e052915ffb037526bfed01e8d7befc8767f4bb8e0fa628365d9
-
SHA512
5368089956fb170ed6cf04d4172843dbe0250484905b3d33d844fbe74bc503873802dadb167aea0d66198e40a8e90ad96cbe3937b6cb930c418c63edc739f4aa
-
SSDEEP
24576:aWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:dnuVMK6vx2RsIKNrj
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\afa9c41340915e052915ffb037526bfed01e8d7befc8767f4bb8e0fa628365d9N.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Users\Admin\AppData\Local\BAJ21gAx\rdpshell.exeC:\Users\Admin\AppData\Local\BAJ21gAx\rdpshell.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\RadE\sigverif.exeC:\Users\Admin\AppData\Local\RadE\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Users\Admin\AppData\Local\nc116mlyE\mblctr.exeC:\Users\Admin\AppData\Local\nc116mlyE\mblctr.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
788KB
MD5b9ac3c3fde9e900aeb8b745eda1ed178
SHA11c5640b25e34a697f1c8fbeee052572ac74adff7
SHA256f2bb36fd9c2af01dd8246e6316e757517fd2448012919c4e043058316861d5d7
SHA512aebb5eaf6327c9ca3fab88833b3672f26490f643ab3bb488c9a8fb7997d51e5475ab9ae8e336d24648f49d4549ce9792c4a24286bd5d8bd074cf9ad3e5740639
-
Filesize
468KB
MD5428066713f225bb8431340fa670671d4
SHA147f6878ff33317c3fc09c494df729a463bda174c
SHA256da6c395a2018d3439ad580a19e6a1ca5ff29ef9074411ee9f9f1b0a6365dfebd
SHA512292aad2762ae4dc519c69411aa114a29894f60ffac103813db4946f2fac4f5a166f66523c421529d6847c0882d8ab467392ee8da1e3a4fca0d6d4e6ebda5b737
-
Filesize
780KB
MD5b9859a1d7d1b66884c94dcc486b46ee8
SHA1ac8ba4639fedc1f7bf9312b93d81b94188a3db6e
SHA256fb59951718c3384c3c56cf9764af1f3c56a9e925a1f9581426808625991a9c74
SHA51216989002869d65f968a2cc6645b7f6ee62ee6eee8127578f7d56d7d8104b8d456bb26aaee25a4b8d3d58938186cf7ee86012efa268b6b9dd1bf88afb703a9706
-
Filesize
77KB
MD52151a535274b53ba8a728e542cbc07a8
SHA1a2304c0f2616a7d12298540dce459dd9ccf07443
SHA256064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd
SHA512e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f
-
Filesize
784KB
MD528fe166677902d8063b334bf913f256e
SHA12d5f5996f932dd78b9402bac110321efe0fa5640
SHA256d568e12d31af658eb57825546e5cd39c0837f80f327de6ba63a283ba0244eea8
SHA512eebd25bdf921dee6cd139589105d318e36c8babd5c586406a60eecdb668b2ddd0caf19a5846dcbce774c88aefeb2628a6561bac1406e9abbb1918b4d33ae3ba0
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
1KB
MD53767f15c98ace0ef504fe435cda324ff
SHA1c3cc70bc585ad81e26dbceb37569345b80294f37
SHA2565dd53cd1576b5fa59dca7aa0dc9b788afae95f5ae2ba5914ed67a61c368962fc
SHA5122816988972b5ea50d38907865ba913ac3baad92969c0c37310591eef6e87df75507fcb2ae8546a51a4a2320e4ba4798bd059792719dec313a40ef2aef1b4bdaa
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
788KB
-
Filesize
28KB
-
Filesize
788KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
784KB
-
Filesize
784KB