Analysis
- max time kernel
149s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
22/07/2026, 17:20
General
- Target 2dc3903dfc1de09bcc71b2b2ce08a348ad9696598c337b7d2072102e15a286c4.dll
- Size 1.3MB
- Sample260722-vwglpszeka
- SHA256 2dc3903dfc1de09bcc71b2b2ce08a348ad9696598c337b7d2072102e15a286c4
Malware Config
Signatures
- Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\2dc3903dfc1de09bcc71b2b2ce08a348ad9696598c337b7d2072102e15a286c4.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\PasswordOnWakeSettingFlyout.exeC:\Windows\system32\PasswordOnWakeSettingFlyout.exe1⤵
-
C:\Users\Admin\AppData\Local\s1AoCH\PasswordOnWakeSettingFlyout.exeC:\Users\Admin\AppData\Local\s1AoCH\PasswordOnWakeSettingFlyout.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mfpmp.exeC:\Windows\system32\mfpmp.exe1⤵
-
C:\Users\Admin\AppData\Local\ouoR\mfpmp.exeC:\Users\Admin\AppData\Local\ouoR\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\neutral\jX0Yw2chq\mfpmp.exeC:\Users\Admin\AppData\Roaming\Microsoft\Spelling\neutral\jX0Yw2chq\mfpmp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\cmstp.exeC:\Windows\system32\cmstp.exe1⤵
-
C:\Users\Admin\AppData\Local\ycVbD\cmstp.exeC:\Users\Admin\AppData\Local\ycVbD\cmstp.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\P3g6S\raserver.exeC:\Users\Admin\AppData\Local\P3g6S\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WTSAPI32.dll
raserver.exe
MFPlat.DLL
mfpmp.exe
PasswordOnWakeSettingFlyout.exe
UxTheme.dll
VERSION.dll
cmstp.exe
Tmzycckzee.lnk
memory/120-80-0x00007FF90EFC0000-0x00007FF90F11B000-memory.dmp
memory/120-78-0x00007FF90EFC0000-0x00007FF90F11B000-memory.dmp
memory/120-77-0x000001F225EB0000-0x000001F225EB7000-memory.dmp
memory/1152-67-0x00007FF90EFC0000-0x00007FF90F119000-memory.dmp
memory/1152-64-0x000001D7A6D10000-0x000001D7A6D17000-memory.dmp
memory/1152-62-0x00007FF90EFC0000-0x00007FF90F119000-memory.dmp
memory/2160-103-0x00007FF90EFC0000-0x00007FF90F119000-memory.dmp
memory/2672-1-0x00007FF907C40000-0x00007FF907D98000-memory.dmp
memory/2672-46-0x00007FF907C40000-0x00007FF907D98000-memory.dmp
memory/2672-2-0x0000019D1FCE0000-0x0000019D1FCE7000-memory.dmp
memory/2816-92-0x00007FF90EFC0000-0x00007FF90F11B000-memory.dmp
memory/5116-26-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-53-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-20-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-19-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-18-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-16-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-15-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-14-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-13-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-11-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-10-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-9-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-8-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-7-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-32-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-6-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-31-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-5-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-23-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-21-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-43-0x00007FF9267B0000-0x00007FF9267C0000-memory.dmp
memory/5116-44-0x00007FF926A30000-0x00007FF926A32000-memory.dmp
memory/5116-22-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-24-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-25-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-27-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-28-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-29-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-30-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-33-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-86-0x0000000002240000-0x0000000002241000-memory.dmp
memory/5116-45-0x00000000020E0000-0x00000000020E7000-memory.dmp
memory/5116-34-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-42-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-35-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-17-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-12-0x0000000140000000-0x0000000140158000-memory.dmp
memory/5116-3-0x0000000002100000-0x0000000002101000-memory.dmp
memory/5692-115-0x00007FF90EFC0000-0x00007FF90F119000-memory.dmp