Analysis
- max time kernel
149s - max time network
138s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 12:41
General
- Target 5fbfe6972c15bf07ce44d5ac89bc0910323f9591bd1b04550c5b23716ee7ec43.dll
- Size 1.1MB
- Sample260730-pw91csyalb
- SHA256 5fbfe6972c15bf07ce44d5ac89bc0910323f9591bd1b04550c5b23716ee7ec43
Malware Config
Signatures
- Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 5 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 6 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\5fbfe6972c15bf07ce44d5ac89bc0910323f9591bd1b04550c5b23716ee7ec43.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\raserver.exeC:\Windows\system32\raserver.exe1⤵
-
C:\Users\Admin\AppData\Local\55KiHHYi\raserver.exeC:\Users\Admin\AppData\Local\55KiHHYi\raserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\CustomShellHost.exeC:\Windows\system32\CustomShellHost.exe1⤵
-
C:\Users\Admin\AppData\Local\jVQ7wO\CustomShellHost.exeC:\Users\Admin\AppData\Local\jVQ7wO\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\FzUHn\CustomShellHost.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\FzUHn\CustomShellHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\PresentationHost.exeC:\Windows\system32\PresentationHost.exe1⤵
-
C:\Users\Admin\AppData\Local\lzdIgFJZL\PresentationHost.exeC:\Users\Admin\AppData\Local\lzdIgFJZL\PresentationHost.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\Vpm\rdpinit.exeC:\Users\Admin\AppData\Local\Vpm\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
WTSAPI32.dll
raserver.exe
WINSTA.dll
rdpinit.exe
CustomShellHost.exe
WTSAPI32.dll
PresentationHost.exe
VERSION.dll
Xmxiqrsquubwhcp.lnk
memory/300-78-0x00007FFF32F40000-0x00007FFF3304F000-memory.dmp
memory/300-75-0x000002482E7D0000-0x000002482E7D7000-memory.dmp
memory/1948-12-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-10-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-23-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-22-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-21-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-20-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-19-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-17-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-40-0x00007FFF4A990000-0x00007FFF4A992000-memory.dmp
memory/1948-39-0x00007FFF4A710000-0x00007FFF4A720000-memory.dmp
memory/1948-18-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-16-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-15-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-14-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-11-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-3-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1948-9-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-7-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-6-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-27-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-13-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-24-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-25-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-26-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-5-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-8-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-31-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-28-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-29-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-48-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-41-0x0000000000900000-0x0000000000907000-memory.dmp
memory/1948-82-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/1948-38-0x0000000140000000-0x000000014010E000-memory.dmp
memory/1948-30-0x0000000140000000-0x000000014010E000-memory.dmp
memory/3852-63-0x00007FFF32F40000-0x00007FFF3304F000-memory.dmp
memory/3852-60-0x0000022D29D90000-0x0000022D29D97000-memory.dmp
memory/3852-58-0x00007FFF32F40000-0x00007FFF3304F000-memory.dmp
memory/5316-51-0x00007FFF3E940000-0x00007FFF3EA4E000-memory.dmp
memory/5316-2-0x00000218FE350000-0x00000218FE357000-memory.dmp
memory/5316-0-0x00007FFF3E940000-0x00007FFF3EA4E000-memory.dmp
memory/5604-106-0x00007FFF32F40000-0x00007FFF33050000-memory.dmp
memory/5604-110-0x00007FFF32F40000-0x00007FFF33050000-memory.dmp
memory/5704-98-0x00007FFF32F40000-0x00007FFF3304F000-memory.dmp
memory/5984-88-0x00007FFF32F40000-0x00007FFF3304F000-memory.dmp