Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27-01-2024 14:19
General
-
Target
The-MALWARE-Repo-master/The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesPerformance.exeC:\Windows\system32\SystemPropertiesPerformance.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\6WuD.cmd1⤵
-
C:\Windows\system32\ApplicationFrameHost.exeC:\Windows\system32\ApplicationFrameHost.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\cWSCY2y.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\JBm8.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Cuzuiwgsauymkw" /TR C:\Windows\system32\3pmmn\ApplicationFrameHost.exe /SC minute /MO 60 /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Cuzuiwgsauymkw"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cuzuiwgsauymkw"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Cuzuiwgsauymkw"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cuzuiwgsauymkw"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Cuzuiwgsauymkw"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cuzuiwgsauymkw"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Cuzuiwgsauymkw"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cuzuiwgsauymkw"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Cuzuiwgsauymkw"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Cuzuiwgsauymkw"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
249B
MD55186f7abc858a45b6e7f79123fc2e996
SHA18d3b71e6cabcfc3688e8efeb7fef932cd72646cc
SHA2562317f80a7f6df140378e98f4d1e83586b4e85aa2ac449bbd97b0e47bb2a8f875
SHA5123f96c6f35eaf0b312e3ed84c291889e6650effb8a5aa1c2c760e4822be2a17747c812bf4b179683a98a2503dd1adb43707bd81249cf9604d7a75e20bb319e303
-
Filesize
144B
MD5ee7520d3047a6487c624921395baa6a1
SHA1b757ecbd5f61cf3289d9786b7d4d9c5b91a72c61
SHA2564319acb4eb0c502d44346043be88643ae02fa5ca6476b4c87f57dc4200657139
SHA51273600f8712dc6ac7e361a8d6a19c4c41fe18a8b5593e7b0b81c84a2204646743ec694f0523f0beb6ad590fd3f251c99249015ea26bcbcfa6233ff1a48102daa9
-
Filesize
628KB
MD5eafa287c3b54ac725edaf032413c9eb0
SHA10fff913b3edc74162c646eacc17bf90950c50f3c
SHA2569b599b383d82e82202f03bd2016c50135d8f45c82163d4bbf7c1443c0e079582
SHA5121e41e8d40f3ebada39460c5c09463da20d0f8b05dd99357f6733aa9266cb7f26da25d0a8f189394c96510d7f157214b35632cf49e7f676b5e6777e34a5646878
-
Filesize
205B
MD5d7db65e2946357e356c9fc19a37ecbcd
SHA1c440b31a7272977343c60cf52a84304c6a538afb
SHA2567a1f9158dbb0104d4c8786a7779edef2b05562036fa4b795ba99b430a317cefd
SHA512a7bacfb5c401a6f77c9b0806d7eccdf2530f1c39fa95879a7ac74af2ff506396cfc3f8efdf7e219b1425d2ffbc4ea11e5fd26c8e690bf0d858cdc977498ed69d
-
Filesize
628KB
MD547fbe88d6b8b29cf5050d1e519419397
SHA12a48e3083ee5f6b4777c19d7a89f0a41ae4800b7
SHA2567bcc4b43a69ef80b88eddccea19eb477104aef9bbd40717caa948bd5f5bd1ed3
SHA5122535ec5454181eec24f58551fa58bcf64a4dbdfc0254245bb63ba7122903aa2986e9732a39aeb0e5eb7a271086424a20e050a89b73cff5659d5b83190baf1987
-
Filesize
1004B
MD54bd066679dd2062485999dd5731bc556
SHA14dd12b99e90f396c6bbb87cfd0817bf34b891edf
SHA256cd1d3e1569d3d7a865378888db983ac5d1554c261bc041e18d9cddc29ebfcf02
SHA51237e944a27851fa66a5b37b27535d86e1eeb3ad78574d8e5322fee5c3dc8645658d0793a649b945d27e3ccc0103c3e13e34a16d39f5b76b7ce5553446a6600440
-
Filesize
82KB
MD5e4fbf7cab8669c7c9cef92205d2f2ffc
SHA1adbfa782b7998720fa85678cc85863b961975e28
SHA256b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30
SHA512c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
4KB