Analysis
- geolocation tags
- user interaction
yes - max time kernel
45s - max time network
45s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
04/08/2026, 06:28
General
- Target 8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f.dll
- Size 1.1MB
- Sample260804-g8a3ssed55
- SHA256 8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f
Malware Config
Signatures
- Family: Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
- Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
- Dridex payload 11 IoCs
Detects Dridex x64 core DLL in memory.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 4 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 10 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 34 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\8a46a34e29b23a7f6b1b7f1094249ecf471497859561d3161f3e0ea060d4d40f.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\omadmclient.exeC:\Windows\system32\omadmclient.exe1⤵
-
C:\Users\Admin\AppData\Local\G4EbtShQO\omadmclient.exeC:\Users\Admin\AppData\Local\G4EbtShQO\omadmclient.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\MDMAppInstaller.exeC:\Windows\system32\MDMAppInstaller.exe1⤵
-
C:\Users\Admin\AppData\Local\GiF\MDMAppInstaller.exeC:\Users\Admin\AppData\Local\GiF\MDMAppInstaller.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Roaming\Adobe\FLASHP~1\xZqYaO\MDMAppInstaller.exeC:\Users\Admin\AppData\Roaming\Adobe\FLASHP~1\xZqYaO\MDMAPP~1.EXE1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exeC:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe1⤵
-
C:\Users\Admin\AppData\Local\tSn90o\SystemPropertiesDataExecutionPrevention.exeC:\Users\Admin\AppData\Local\tSn90o\SystemPropertiesDataExecutionPrevention.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
XmlLite.dll
omadmclient.exe
MDMAppInstaller.exe
WTSAPI32.dll
SYSDM.CPL
SystemPropertiesDataExecutionPrevention.exe
Eaxjtebddookt.lnk
memory/1872-100-0x00007FFDA0290000-0x00007FFDA039E000-memory.dmp
memory/2152-88-0x00007FFD9F4B0000-0x00007FFD9F5BE000-memory.dmp
memory/2184-77-0x00007FFD9F4B0000-0x00007FFD9F5BE000-memory.dmp
memory/2184-73-0x00007FFD9F4B0000-0x00007FFD9F5BE000-memory.dmp
memory/2184-72-0x0000019CA26F0000-0x0000019CA26F7000-memory.dmp
memory/3164-24-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-40-0x00007FFDBC6B0000-0x00007FFDBC6C0000-memory.dmp
memory/3164-21-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-20-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-19-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-17-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-16-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-15-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-14-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-13-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-12-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-10-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-9-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-8-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-7-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-6-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-11-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-5-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-38-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-22-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-39-0x00007FFDBC6C0000-0x00007FFDBC6D0000-memory.dmp
memory/3164-47-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-3-0x0000000002FD0000-0x0000000002FD1000-memory.dmp
memory/3164-18-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-25-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-23-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-30-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-81-0x00000000011F0000-0x00000000011F1000-memory.dmp
memory/3164-26-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-27-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-28-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-29-0x0000000140000000-0x000000014010D000-memory.dmp
memory/3164-37-0x0000000002FB0000-0x0000000002FB7000-memory.dmp
memory/4004-2-0x0000023F96580000-0x0000023F96587000-memory.dmp
memory/4004-50-0x00007FFDAC6F0000-0x00007FFDAC7FD000-memory.dmp
memory/4004-1-0x00007FFDAC6F0000-0x00007FFDAC7FD000-memory.dmp
memory/4104-62-0x00007FFDA0290000-0x00007FFDA039E000-memory.dmp
memory/4104-59-0x00000241FD930000-0x00000241FD937000-memory.dmp
memory/4104-58-0x00007FFDA0290000-0x00007FFDA039E000-memory.dmp