Analysis
-
max time kernel
150s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
-
submitted
11-11-2023 13:40
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 40 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\psr.exeC:\Windows\system32\psr.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\VDuUYwJ.cmd1⤵
-
C:\Windows\system32\tcmsetup.exeC:\Windows\system32\tcmsetup.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\tfs.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\IKz.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Nbydosbeeflsb" /TR C:\Windows\system32\PJrGnpu\tcmsetup.exe /SC minute /MO 60 /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Nbydosbeeflsb"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Nbydosbeeflsb"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Nbydosbeeflsb"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Nbydosbeeflsb"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Nbydosbeeflsb"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Nbydosbeeflsb"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Nbydosbeeflsb"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Nbydosbeeflsb"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Nbydosbeeflsb"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Nbydosbeeflsb"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD58ef0b56e74f2aace2ae3c275a196845c
SHA112dcb6ccad7bb10577f2a82f1dae24e0c01dc25e
SHA256c67f2d85023f0683e904f3d3d61276b49b0441f3c1dc014331dce82be86c4854
SHA5124ee23b1c6523d30d21ea1ea985c9e2c8d1e83f734a774122316c04d26314bca1ef8597fce7cf5f97a054bc111b264b6eb4c6f66a307b71e09573ddda5e9e9af6
-
Filesize
133B
MD5d8250ee929df188de216e4e403333e2e
SHA1642febf32aa0ef293404c5db8179a9deb93c06f7
SHA256919e4cacdc156f1af3bd816f51ee2411eaab00b32b1b75d9e53a7626d95f4e08
SHA512eacb110a56d708fa4fc0cdf7571258b801a6216545e7cbf30500586e47b82ac2db86dfa0ccc4e9e6024d711df1751ac6e18e22d494bcc6fddc630a49fa4a34e8
-
Filesize
230B
MD512ac855de9729c720b93a4aafadf00c8
SHA1b2fc189d50cb3e89354268039eba4b7d57852ab7
SHA2562e0456c2fd9efcc3f41d038b93ffbac0f86cc49fb2271349f6452b3a1a45ff44
SHA512515251bfb587de2704bf3472b2e06f306ed7bb158a4f2b6b0559b3d60acddc31340d71cd7ec49992641e8a733bd6c50d3c7114e6a105b77795dcb52b55b35b22
-
Filesize
636KB
MD535e17d3c43167823cc3e4bfee8a103b8
SHA1e17af1c29f02d9eb45cd2d02618467e131847357
SHA256ebdc5dd5a7e62f1155f629d72658d02a0c2eda31e5be4aeb5b7846231e7c5d11
SHA512dde2006b7d99ff9d13789bba54cba9fe5729bc867d0aae57fe53bfe6f85d3d36ee18ca4808fa07e2059ef48a67203f41b2080e5d93ba4ec687bd5dd99578db64
-
Filesize
202B
MD5f792697d63b687e8679dab0f622ed5ef
SHA1e548568e40f5a23bad3a369e3304c19baa81a3dd
SHA256c5017576d43461022aaba18e41775d03e470bbdd08990206f5d29612f4023edb
SHA512a3ec9178821073ef18a359eee5338277a107e737423e41dd3b5f9444fecd4c04b11143ff9bb31c056f99e9f0ba7f2b70dba4d9660338729771ffe7446f3fc5a1
-
Filesize
892B
MD5e0e0f36b3e0a7f9180eb6d44de472dcb
SHA178d5a4f5582e9701eecdf129cbf8cbca1fad4749
SHA2568ed7c9724dd3298486bd7d86dc205acff536cf306c83c74e9f9043cf76c5cfea
SHA512e2e85f91c4c294ded9bf08c6071b924f11b6d0c98b930881e63b9325a32cdd7f1972c3db7124b6946542622048710c2019b20737f4a354389783538de49ea55b
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB