Analysis
- max time kernel
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
01/06/2026, 19:24
General
- Target cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.dll
- Size 2.2MB
- Sample260601-x4b3asft2n
- SHA256 cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2
Malware Config
Signatures
- Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Drops startup file 3 IoCs
- Executes dropped EXE 6 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cfeb52567252c1683608be3465ebe471ae8d9bc21ce5958e80d6aacd17a2c9a2.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\msra.exeC:\Windows\system32\msra.exe1⤵
-
C:\Users\Admin\AppData\Local\JWl49i\msra.exeC:\Users\Admin\AppData\Local\JWl49i\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\consent.exeC:\Windows\system32\consent.exe1⤵
-
C:\Users\Admin\AppData\Local\71a\consent.exeC:\Users\Admin\AppData\Local\71a\consent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\DeviceEnroller.exeC:\Windows\system32\DeviceEnroller.exe1⤵
-
C:\Users\Admin\AppData\Local\tkjSh\DeviceEnroller.exeC:\Users\Admin\AppData\Local\tkjSh\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\fCO7\PresentationHost.exeC:\Users\Admin\AppData\Local\fCO7\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EYIPRZ~1\msra.exeC:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\EYIPRZ~1\msra.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\BGEO5\DeviceEnroller.exeC:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\BGEO5\DeviceEnroller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
consent.exe
NDFAPI.DLL
msra.exe
PresentationHost.exe
VERSION.dll
DeviceEnroller.exe
XmlLite.dll
Yqxtbwvdo.lnk
memory/2188-105-0x0000028E49590000-0x0000028E497CE000-memory.dmp
memory/2188-111-0x0000028E49590000-0x0000028E497CE000-memory.dmp
memory/2188-106-0x0000028E49590000-0x0000028E497CE000-memory.dmp
memory/2792-2-0x0000000140000000-0x000000014023D000-memory.dmp
memory/2792-10-0x0000000140000000-0x000000014023D000-memory.dmp
memory/2792-0-0x0000020ABFC70000-0x0000020ABFC77000-memory.dmp
memory/2908-141-0x0000000140000000-0x000000014023E000-memory.dmp
memory/3224-20-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-17-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-35-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-34-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-33-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-32-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-31-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-30-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-29-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-28-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-27-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-26-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-25-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-22-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-21-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-38-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-19-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-16-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-15-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-9-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-8-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-23-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-24-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-36-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-18-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-14-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-13-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-12-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-11-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-39-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-46-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-53-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-4-0x0000000000D70000-0x0000000000D71000-memory.dmp
memory/3224-6-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-114-0x0000000002CA0000-0x0000000002CA1000-memory.dmp
memory/3224-113-0x0000000002C90000-0x0000000002C91000-memory.dmp
memory/3224-7-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-61-0x0000000000D50000-0x0000000000D57000-memory.dmp
memory/3224-62-0x00007FFBC6850000-0x00007FFBC6860000-memory.dmp
memory/3224-55-0x0000000140000000-0x000000014023D000-memory.dmp
memory/3224-37-0x0000000140000000-0x000000014023D000-memory.dmp
memory/4252-66-0x0000000140000000-0x000000014023E000-memory.dmp
memory/4252-71-0x0000023255990000-0x0000023255997000-memory.dmp
memory/4252-72-0x0000000140000000-0x000000014023E000-memory.dmp
memory/5020-140-0x0000000140000000-0x000000014023E000-memory.dmp
memory/5072-94-0x0000000140000000-0x000000014023E000-memory.dmp
memory/5072-93-0x000002B591A00000-0x000002B591A07000-memory.dmp