Analysis
- max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/07/2026, 12:41
General
- Target 770db15314f10e597739b71aeb7e7cec6432464e2671270e59a16f8f10e4c45a.dll
- Size 1.1MB
- Sample260730-pxaa5ayalc
- SHA256 770db15314f10e597739b71aeb7e7cec6432464e2671270e59a16f8f10e4c45a
Malware Config
Signatures
- Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\770db15314f10e597739b71aeb7e7cec6432464e2671270e59a16f8f10e4c45a.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesRemote.exeC:\Windows\system32\SystemPropertiesRemote.exe1⤵
-
C:\Users\Admin\AppData\Local\nNZQzsNpT\SystemPropertiesRemote.exeC:\Users\Admin\AppData\Local\nNZQzsNpT\SystemPropertiesRemote.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\jsyw\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\jsyw\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\491ROeMAtZ\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\491ROeMAtZ\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\win32calc.exeC:\Windows\system32\win32calc.exe1⤵
-
C:\Users\Admin\AppData\Local\3bTodpugo\win32calc.exeC:\Users\Admin\AppData\Local\3bTodpugo\win32calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
UxTheme.dll
win32calc.exe
SYSDM.CPL
SystemPropertiesDataExecutionPrevention.exe
SYSDM.CPL
SystemPropertiesRemote.exe
Tmzycckzee.lnk
memory/688-88-0x00007FFBE7590000-0x00007FFBE769F000-memory.dmp
memory/1244-75-0x0000014E46C10000-0x0000014E46C17000-memory.dmp
memory/1244-78-0x00007FFBE7590000-0x00007FFBE769F000-memory.dmp
memory/3140-51-0x00007FFBE71C0000-0x00007FFBE72CE000-memory.dmp
memory/3140-0-0x0000029AC79E0000-0x0000029AC79E7000-memory.dmp
memory/3140-2-0x00007FFBE71C0000-0x00007FFBE72CE000-memory.dmp
memory/4500-100-0x00007FFBE7590000-0x00007FFBE769F000-memory.dmp
memory/4660-63-0x00007FFBE7590000-0x00007FFBE769F000-memory.dmp
memory/4660-58-0x00007FFBE7590000-0x00007FFBE769F000-memory.dmp
memory/4660-60-0x000002C072A50000-0x000002C072A57000-memory.dmp
memory/5576-27-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-5-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-39-0x00007FFC03350000-0x00007FFC03360000-memory.dmp
memory/5576-18-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-17-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-14-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-16-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-15-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-12-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-11-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-9-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-7-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-25-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-6-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-20-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-21-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-19-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-40-0x00007FFC035D0000-0x00007FFC035D2000-memory.dmp
memory/5576-13-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-22-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-24-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-23-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-26-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-28-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-41-0x0000000003580000-0x0000000003587000-memory.dmp
memory/5576-29-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-48-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-30-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-82-0x0000000003E10000-0x0000000003E11000-memory.dmp
memory/5576-38-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-31-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-10-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-8-0x0000000140000000-0x000000014010E000-memory.dmp
memory/5576-3-0x00000000035A0000-0x00000000035A1000-memory.dmp