Analysis
-
max time kernel
149s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
04-09-2024 20:01
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 10 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\RecoveryDrive.exeC:\Windows\system32\RecoveryDrive.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Mczz4p.cmd1⤵
-
C:\Windows\system32\wbengine.exeC:\Windows\system32\wbengine.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\h7uFo2.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\OrMao4j.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Qdvojli" /TR C:\Windows\system32\Iyx1\wbengine.exe /SC minute /MO 60 /RL highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Qdvojli"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Qdvojli"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD545c99a94f559f9e4a93b6096043890bb
SHA1f3e02bebfb0cdf6aac2a6782acce6931b4c6287c
SHA2563efce7e77209052b0159588f3e94b41fd34d9199fceff08a0c88dc2d3e2e17e9
SHA51294fad758b4ea970ba1e8b54e2d0748832009d0d9cff20516883a37e90927787f64b4970c4997a3266e9a820479bc004f19c0d6b696a706791f5ef371a02425e9
-
Filesize
239B
MD5a27a2a0effc1711a81c28371d74fa60b
SHA1ab074ec19eac2c5a0b44df05ea92dd003c621155
SHA2568be40d27ff168c9a0cd6927285139262e713778568e7e341c1a7556819d2bb89
SHA5124d04bb6428f0b0e1614b96af2123a77ea1748f89cf388f18b2fe957539a1ef27c5c163b6706c868706bd4573fe8a2817a8ac93bf936bbf6357950aa0798f2825
-
Filesize
124B
MD56b80f661b41e8d91f465957eda7c0531
SHA19656d53bbb9ba2cadf3b573ef0b2e19e7a4a3230
SHA2560a19c109cab4c5739512a668b7c613ec0d0ab8c40326653bbdec33dbc9bdb612
SHA51290b8a22f33a22b26350399bf2f8e39eb1586ed857cc4632afbbeb33c0ccb0d19d575697b4359701096bc1228aef45d5c261fdb863a78213b9012ee7b2be35ab3
-
Filesize
193B
MD5054700d42bbf1d1442986c38395e647e
SHA1ad21a5350b20e54bf45971ed3f8db7c65859cbf6
SHA256b0fc161ff520232624b2b6200302edf179ba6fdf1c21a25aa8da594b91c5ad15
SHA5127183c226784fdcd74034b33d9139a644fcd079f6bbfda10aa21a1a691b5d9c01110da64f297665b4f44b62dd43c4b6a0b5d8200bc4eff3f29373ff3304dbb0f9
-
Filesize
632KB
MD5639a8a082e6284fbc68dfdc77ea44427
SHA198aee8f25c24c16639dab573d9d3411e579c257e
SHA2569c6bd4fd6cb4fb3958fd55434ad6fc93f16220fa934a424b8d4646bcb3ed72e0
SHA512603a3ce9386d0e2d64c7b62bce6a980d21898ec915543f9444b69bcaf3ee1fc95b1fb24817dab99a3c5db916493dc06781e7f48ef1a2ccad080c473087c27178
-
Filesize
911KB
MD5b9b3dc6f2eb89e41ff27400952602c74
SHA124ae07e0db3ace0809d08bbd039db3a9d533e81b
SHA256630518cb2e4636f889d12c98fb2e6be4e579c5eeb86f88695d3f7fff3f5515c4
SHA5127906954b881f1051a0c7f098e096bc28eddcc48643b8bf3134dd57b8c18d8beba4f9a0ac5d348de2f9b8ea607c3e9cb0e61d91e4f3ba1fefb02839f928e3e3fe
-
Filesize
942B
MD564f66e448f32bd08d6b7a307d13fcfea
SHA1f532d318d4685258843f1cb303d54ab77d508821
SHA25619829b251eb4d007f60442a1e40a4ec53425476eee35ebfaea814445fa643a8d
SHA512c575d459759fa95cbcf5b0a9eed7bb0f65a6bab12910c24867f40d6371f1733330bd253112c9dd6aeab2da57e21d343fa4d41985fca3148fad6009260f1eb978
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB