Resubmissions

29-04-2024 17:56

240429-wjgllsgg29 10

17-04-2024 14:59

240417-sc15wsef8y 10

16-04-2024 14:20

240416-rnxq6sdg3t 10

Analysis

  • max time kernel
    1676s
  • max time network
    1687s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-de
  • resource tags

    arch:x64arch:x86image:win10-20240404-delocale:de-deos:windows10-1703-x64systemwindows
  • submitted
    16-04-2024 14:20

General

  • Target

    The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.exe

  • Size

    152KB

  • MD5

    6164228ed2cc0eceba9ce1828d87d827

  • SHA1

    cea5bc473c948a78ce565b6e195e6e25f029c0c6

  • SHA256

    7fa83f0588f0f50d0635313918137c05cb59aa672d842f864073aebb72c66195

  • SHA512

    b53ac27397ce5453fa008d1a2e98f9f66be7d7f08375b92c88007544c09ab844d6c8eeceb2221c988e0a0d6ffc2a8a290e49715e3062a74bcd2310d41bffcc37

  • SSDEEP

    3072:VqD/ri6AM4odK4J663POAQgG8rYKvh+5Nl:V0xlIBwPOA+8Zhu

Score
10/10

Malware Config

Signatures

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

  • Deletes itself 1 IoCs
  • Discovers systems in the same network 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.exe
    "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.exe"
      2⤵
      • Deletes itself
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\SysWOW64\whoami.exe
        C:\Windows\system32\whoami.exe /all
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:3068
      • C:\Windows\SysWOW64\net.exe
        C:\Windows\system32\net.exe view
        3⤵
        • Discovers systems in the same network
        PID:3212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2356-7-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-13-0x0000000000EA0000-0x0000000000EA6000-memory.dmp

    Filesize

    24KB

  • memory/2356-2-0x0000000075BF0000-0x0000000075CC0000-memory.dmp

    Filesize

    832KB

  • memory/2356-3-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

    Filesize

    4KB

  • memory/2356-9-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-6-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-29-0x0000000075BF0000-0x0000000075CC0000-memory.dmp

    Filesize

    832KB

  • memory/2356-12-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-11-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-10-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/2356-8-0x0000000002FD0000-0x0000000002FFF000-memory.dmp

    Filesize

    188KB

  • memory/4628-5-0x0000000002F00000-0x0000000002F2F000-memory.dmp

    Filesize

    188KB

  • memory/4628-0-0x0000000002F00000-0x0000000002F2F000-memory.dmp

    Filesize

    188KB

  • memory/4628-1-0x0000000001560000-0x0000000001566000-memory.dmp

    Filesize

    24KB