Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
-
submitted
18-07-2024 21:48
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 10 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\mblctr.exeC:\Windows\system32\mblctr.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\p8Yq.cmd1⤵
-
C:\Windows\system32\rdpshell.exeC:\Windows\system32\rdpshell.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\6QyI.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\9vb1jH.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Essufqssgel" /TR C:\Windows\system32\O3KrzU\rdpshell.exe /SC minute /MO 60 /RL highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Essufqssgel"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Essufqssgel"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD5764698c8a3287e580d6db38ae53bf2d7
SHA1f8cabfb0739c119ccfe921be0b45c1824429c00d
SHA2561845920cb014f63cfd1cf0f00698bf1dc1c8c1a99414c5b238032af5bf3001ae
SHA5121f274463d72049b98cc86d63ea85dda78108dbc0dc4c41c1a32ca92ca6ca97089ad3b241043388903eb0b50c53fd00a279cf44b54041be79734d908cce953122
-
Filesize
200B
MD5075c393e405e6f7acab94e1834c3a878
SHA1a61c88e2fdae2b7fd1c325111502c4b876089771
SHA2568abb0f55e2c1acdb47dc2b78a06e35bb81bac5714d228bd209111f8a223d4dcf
SHA5120d55a6faac5dbf3d58fdde433e5c6e81997e7373747c47c62b4d86dc32793882de1f541d8b96bfa33ae29494c74efa6955cc554588917d38a1a411ba67d6dfc6
-
Filesize
130B
MD51dd88eecf641dfb88cb37a34e3269fcc
SHA1d3c8fe447d051f05711588b86b1a4dd9a4c606e7
SHA2564cca8a25c80ec434b75546cd3e6f03f0cb996e59842f23b065208b18cce28bed
SHA51243478867561405b0a824d0e5c5c0224aff5e45442f17f93574b22e7d3420c6d90ec60f5848e93b44ffaaef04cd39bd364e0bf5b5f5988a1b9eee4cd14aa7f1e1
-
Filesize
632KB
MD5859bae1dd9141753a733b407673d96be
SHA1cab10be4573841c86d72af4935ec5b7241428932
SHA25612033e3a2e4172480020b21c82a4144b11a8b8efcc89ee5dffc5fe90b18e5695
SHA5127f9c3c5a99ca22476a75fe53ceeb50f0dbc97bac9a378747f63d7f0fd3303aba71d975a67f958bed49fa64e0e164fbfeadbf55cd5e3c98289ab7d84e5222eaa9
-
Filesize
227B
MD5d09b2d185a2c67c99231bb46fa8dd18a
SHA12457996c6422b3d2a7ee0ff0d2d54fd49c70005c
SHA256058fe1e1b3c696f51734cf0b38cc2273f06c286627958a0858a636ae096c9a68
SHA512bef6ae5c2bc3c364d56b83072e796cf7638cdfb8cfd17c1691b35cadd0e717e735762419eccabf1d2ff855532015fa962252b30d42c473d72111d0a3255be703
-
Filesize
898B
MD5875f5df032472e90508c3f264ac124a8
SHA18fa957bf1dbeaaa8bb99b2bc410e2f7e1ef8d7c8
SHA25650f01d30881d65b58ef65286846000d5f39c6ccd7c1bc0e9507d82464ba8f12d
SHA512311e2f68d3dd993f7498074fb40dd95743efcbe6246415a0cbb1dba40cd33db88600fd2fbb85d24f6f1d22b14cf12f9514094618467edd3ea48a2f5d151e622b
-
Filesize
790KB
MD5d3db14eabb2679e08020bcd0c96fa9f6
SHA1578dca7aad29409634064579d269e61e1f07d9dd
SHA2563baa1dc0756ebb0c2c70a31be7147863d8d8ba056c1aa7f979307f8790d1ff69
SHA51214dc895ae458ff0ca13d9c27aa5b4cfc906d338603d43389bb5f4429be593a587818855d1fe938f9ebebf46467fb0c1ab28247e8f9f5357098e8b822ecd8fffe
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB