Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
01/03/2024, 21:28
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 10 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\bdechangepin.exeC:\Windows\system32\bdechangepin.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\6yO.cmd1⤵
-
C:\Windows\system32\rdpinput.exeC:\Windows\system32\rdpinput.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\LrN.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\n4l.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Uhljwyxbarwpt" /TR C:\Windows\system32\uyDTf\rdpinput.exe /SC minute /MO 60 /RL highest3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Uhljwyxbarwpt"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Uhljwyxbarwpt"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Uhljwyxbarwpt"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Uhljwyxbarwpt"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Uhljwyxbarwpt"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Uhljwyxbarwpt"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Uhljwyxbarwpt"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Uhljwyxbarwpt"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Uhljwyxbarwpt"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Uhljwyxbarwpt"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
229B
MD513afe7a1443f53c6bd5c42cb077382ac
SHA1d72b7870a31acb50ad88741fc606369c882369dd
SHA256939dffdf106afa895e2895bc38aaaa7105c9e1a3b81fa44bd8c306f18041475d
SHA5129ff5f1fc87302ba88274da883a0bea24b230afb32c2c75867ca810ed28e7d6a43887c54adbad0ff7821cc40517c5d693a531e78b7c782d09ca870eaf02261d6f
-
Filesize
908KB
MD54262b676894c5b59e9c86b514a79ba85
SHA1cc6b83eff755a2fc96569bccb1cc503399fbd308
SHA2567f01d87601561c20977c21fb8ab9fb97a2e9789c7720cbc2d6d6e456d4150fc8
SHA512f6eab35d15e5e6793de1706995034e9a9fba37ec3a118baa35557848d92d94fffb5dab02470cdb5f627fdae2a9b0b354489a40136d94b090c3c4fe29d50b87d4
-
Filesize
199B
MD542ca6bb649c7acdfb01ade2f0846057c
SHA14f41e4c3721472b56f7843e8e35f5819548a7e65
SHA2565da151391c96c1f556dc512322a4fc2f097adf40d6edf7baf9808315e8bb4a0e
SHA512af128096d318f24b56f5fde2a245afde59475ad08542a065e1c7719493ef9a9c63ab8734bfef831be0ef6cbd039cb83de2062fcc000fcd008c4e86d8523dd212
-
Filesize
632KB
MD5a6f2e9a1d7779f952aa30c6c6e06bd7b
SHA10e63389af13506ead52b6609c3166605f2e23ee9
SHA2562f7504c82ca2e97b73af982975f7ca02a5f4c03549954dddd49f97fab81cc3a7
SHA5121b1ff390896656862cc2487a417642adc006b781e38a5d3de40336dcb53364cd71e1eb5b08cf65fbd588b3c63f72c97b1689e55f80c2f170e9340d8e7e439819
-
Filesize
131B
MD50694f605aedb5cae16cde7219f066d0b
SHA116cc0107ebdc3ecf1642b7ad1501386bc73dbf9a
SHA256fbc318b4f044dabefaca2fae460eba196702e1b0d1a5f9fbcb75246c93ee1fb5
SHA512d62ac90476f8d72abfe20aed542854386b0ba1f857053f5380be34b41e1715243210d8e41fc08bc9dfa898b78d1abf5d88282b1c3e3cb60d2d8b9153925a9aab
-
Filesize
373KB
MD5601a28eb2d845d729ddd7330cbae6fd6
SHA15cf9f6f9135c903d42a7756c638333db8621e642
SHA2564d43f37576a0ebbaf97024cd5597d968ffe59c871b483554aea302dccb7253f6
SHA5121687044612ceb705f79c806b176f885fd01449251b0097c2df70280b7d10a2b830ee30ac0f645a7e8d8067892f6562d933624de694295e22318863260222859d
-
Filesize
920B
MD589e0f5133601960ccf1e5f0e142762d6
SHA19de67fb151344866b134a9d16e97b8b473fe1ad0
SHA256802ccb553aaef30ee8ef1ae227f576cd69c3b448b7cb475960195d2ce53e8deb
SHA512a9cd6bfc129c10682440a0f7d48b1cb7c7291685cccce7e1c157c0a99c906bf317a51b4bbcbe651f45987fec905f5814ae214d7872f18118c1d9c10551517130
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB