Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
24/02/2025, 11:19
General
-
Target
794e1fc591d09ba1650cb356384f33dc3a1a4810cb9c64f9d30b24b8c3ac8a43.dll
-
Size
780KB
-
MD5
1554104d7f9db2f8a779405eb5707b9b
-
SHA1
77434050361476de655662ac77e4543ed387f653
-
SHA256
794e1fc591d09ba1650cb356384f33dc3a1a4810cb9c64f9d30b24b8c3ac8a43
-
SHA512
f278140c72faf11cf14cfe885016034dd735ad569c8ee5cb9ae4a6d5694e7ed91b491ae02ef9473d1554d2da19292598d44414c1c714b506929be0fb46307ad1
-
SSDEEP
24576:aWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij+:dnuVMK6vx2RsIKNrj+
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex family
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Drops startup file 3 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\794e1fc591d09ba1650cb356384f33dc3a1a4810cb9c64f9d30b24b8c3ac8a43.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\Op5LtTU\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\Op5LtTU\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\upfc.exeC:\Windows\system32\upfc.exe1⤵
-
C:\Users\Admin\AppData\Local\bqTfCNhX\upfc.exeC:\Users\Admin\AppData\Local\bqTfCNhX\upfc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\WindowsActionDialog.exeC:\Windows\system32\WindowsActionDialog.exe1⤵
-
C:\Users\Admin\AppData\Local\JbUsTTg\WindowsActionDialog.exeC:\Users\Admin\AppData\Local\JbUsTTg\WindowsActionDialog.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD50f83cf545952ec3edad3413865568389
SHA19e0145d488ac07e9dff151c244c4a156df616344
SHA2566b2e89e778eb8ac50ab14a7e8156afb92f49dfcc9dcc28f76fea6175a0e826fd
SHA512d370fd1bf7b921ceae073c634b4a777264cf8aaf3dbb0736a4df42750e0b986e205c7eea5dfa4ccf0bd8859c1b237d414ba59ad39dd1d7d9b41a6d091c46c971
-
Filesize
1.0MB
MD50a2c946dd45777092c5c22c88140c508
SHA1af9703dec5f315e7ce35afbaac26a60b2ce0c373
SHA256ed7d3988737413949f935368a342bea618508b47adffe6b5cc811c1dd42ff596
SHA5125da4cde787a7b8d0dbfacf0ad2474faa13db5e1f932cb8d5cbcfe0b7291a14bf98e516e61973d146e55b0bc827fc596519d4748836ca72f1a657aa1590d0965c
-
Filesize
61KB
MD573c523b6556f2dc7eefc662338d66f8d
SHA11e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5
SHA2560c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31
SHA51269d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912
-
Filesize
780KB
MD5da4a56a9451f2a4ba7d0eb06d75c2a12
SHA164449fbf85cf25468b96b45f09917449da31c439
SHA25622345be870846457cca3dddb2fba20b2841c15be069adb05ea62f0af653c8944
SHA5127d00cd7f450d2bd9cd2954de2178bd39433ba8f0780fd35de8dff9a39324701512f82ca6c17fb4620069281fa235904edea012d10606e12b4968ffc6b9cad715
-
Filesize
118KB
MD5299ea296575ccb9d2c1a779062535d5c
SHA12497169c13b0ba46a6be8a1fe493b250094079b7
SHA256ee44fe14df89c4e5eaf8398f8fb4823fd910c5a94d913653d6b9e831254f6cc2
SHA51202fc2b25167ebd7dfcc7b8aa74613e7004fdf33dfccccba6c3427434cca981c2eb50f4a801969b3a40c495a9bb0eac8176f4f2ec9091916cf3509a7f909b30fa
-
Filesize
1KB
MD568d5be7b25f73edbe694e8880d405dc2
SHA1bfddfb3275677903a5ede0ff8a3cc1ba4e1ec0ba
SHA25693e0a85164da9119e427a192a76756c032e73c8ff78029b9c4b5873e84abbe95
SHA5129c07b1934248f553d0b8f6397d92ef6f9940ce833132d8c9e22c7c5136179ea447fee6827d8f22b1f658ab0161f6f13e4ef35da7704a99404df3b50dc92cec64
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
780KB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
28KB
-
Filesize
780KB
-
Filesize
780KB
-
Filesize
28KB