Analysis
-
max time kernel
153s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-01-2024 14:19
General
-
Target
The-MALWARE-Repo-master/The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 9 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 51 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\recdisc.exeC:\Windows\system32\recdisc.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\sk7zmPQ.cmd1⤵
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\6TwGKQ.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\VFy.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Hkckipfn" /TR C:\Windows\system32\2XSO\dccw.exe /SC minute /MO 60 /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Hkckipfn"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Hkckipfn"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Hkckipfn"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Hkckipfn"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Hkckipfn"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Hkckipfn"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Hkckipfn"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Hkckipfn"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Hkckipfn"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Hkckipfn"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD559ac6bf81144be63ada79e2df7b8da30
SHA1576ccdad6820355b3d0eece8336dd03e45915259
SHA2566812928ad675e829697d2afad6347841e6c8f7ef4528386d3f80f2ff1f3416c8
SHA512a91d4d70523edb4adb4b884be9a6e5ac0ecc11b983ea6a6b8ce003b33e2b9438a6ff67b412188277b64a2af77f6db29b97c01c1b8cf3e7ed58d53ea78bbcb746
-
Filesize
628KB
MD5868f6b71ef80c8329588655ca8264c7f
SHA11e6be8a0619087cbf56b0a6693048b9123ce09e6
SHA2566c358509100a3f221e0f5cb72cc1268b9fc38e763ee8cf32bae592e871b4dc17
SHA512cb9b395149f129f7d8b7c651b65f3eeebf0e2052d2b850002669690dd0048dd078c0a63fc870e681228d1143c1c23e003a7ebdcb9b6ee03d0efedae79b733a55
-
Filesize
121B
MD5e011f466281b18a877a36b2eab23d0c9
SHA11220e33e938d29b25f6281075a189f93b830cb06
SHA256b8a7e8b3ba40bff696cc8a9b9b831ee4d10ab47fe0393683aacf52bae0639825
SHA51246ba2c889d89adee39600425f0a72fe7898adec0752ec01119595e47cb1743219d2ca82182f62565743bb44a8ea8cf3d7ad3d70743d1946437fcca437514a6e1
-
Filesize
628KB
MD5b0cca5eb15611095166a799637025bb9
SHA1d4524e44b470059bff7d0c02e7f333d935186f56
SHA2569f62e3032b29b22b64d9cb3c29bf21a34d932c738cf54e257531d4b1cbdf9d4e
SHA512462e2f127e50dd4f19556e6b85874069b7f6aa27e5ccba7ecbfb8da32120e06d3f9b433113a8d0bb519762a2aefd8ac7947eb6c161bfdd043f2343cce6a2c910
-
Filesize
232B
MD5fa31ef0c555fe05b21e38849efa10c7d
SHA133341e7a18f97b5e92c8deb7e20dd03a6c73cfed
SHA256797edec972df8a27282cc542899ee705259621c2a29c3e67ee74688d04b07e31
SHA512c6fb35055bd631215378a423e774ee1cc96ef610cd090f17395873ee74112df7d23f5cacaab6e1bc74310b7e4034e2fae2ee4266a559362e02ce865158841f17
-
Filesize
232KB
MD5f3b306179f1840c0813dc6771b018358
SHA1dec7ce3c13f7a684cb52ae6007c99cf03afef005
SHA256dcaeb590394b42d180e23e3cef4dd135513395b026e0ed489aec49848b85b8f0
SHA5129f9ec4c2ca6373bd738bf415d059f3536390e46e5b0a560e9ee1b190407a6d0f481c38664c51b834a9e72d8878f71c3c19e427e3a6b5ca4ec6b02d1156eb9ef4
-
Filesize
880B
MD595009c124a895a339d0a08ab1c2f14c9
SHA160281d8efc316540f540f378d59570b08ba4210b
SHA256823448ea8654198c8378f7c4ab9d5677b88accc0895e8de4e2537e602d95d097
SHA5124bb3a8c0e4e6011e8efb271580aad9c91cef14003572249d843a93b40ea5e8ee66b18ef2ad736e72f381d454b942052e075d111fe1d8d15039b58ce35a486dad
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB