Analysis
-
max time kernel
120s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
01-03-2024 21:28
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/DridexLoader.bin.exe
-
Size
212KB
-
MD5
c26203af4b3e9c81a9e634178b603601
-
SHA1
5e41cbc4d7a1afdf05f441086c2caf45a44bac9e
-
SHA256
7b8fc6e62ef39770587a056af9709cb38f052aad5d815f808346494b7a3d00c5
-
SHA512
bb5aeb995d7b9b2b532812be0da4644db5f3d22635c37d7154ba39691f3561da574597618e7359b9a45b3bb906ec0b8b0104cbc05689455c952e995759e188b6
-
SSDEEP
3072:Te8LOIa22GwayjbzJ4xgAW8NeN00w7Aoalm2HdTStgjuPaMe+H9tJA:iUOIa2sZjPJJQiw4igjAL
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
-
Discovers systems in the same network 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\DridexLoader.bin.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whoami.exeC:\Windows\system32\whoami.exe /all3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe view3⤵
- Discovers systems in the same network
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
24KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
4KB
-
Filesize
1.1MB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
216KB
-
Filesize
1.1MB