Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
15-09-2024 15:07
General
-
Target
Trojan.Win64.Dridex.ABM.dll
-
Size
984KB
-
MD5
5b4ed52afad791ec0dc42503eb380110
-
SHA1
51da3175f1952b77a4cbe7d5f25651cebf663d13
-
SHA256
b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2
-
SHA512
49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac
-
SSDEEP
12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ABM.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\sethc.exeC:\Windows\system32\sethc.exe1⤵
-
C:\Users\Admin\AppData\Local\CyaOC\sethc.exeC:\Users\Admin\AppData\Local\CyaOC\sethc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\rdpclip.exeC:\Windows\system32\rdpclip.exe1⤵
-
C:\Users\Admin\AppData\Local\VV1\rdpclip.exeC:\Users\Admin\AppData\Local\VV1\rdpclip.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\Q3DEN60bc\osk.exeC:\Users\Admin\AppData\Local\Q3DEN60bc\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD5106b47c947296757488759f8b9b5f345
SHA1a729b40ff473b53b5bbd6009e373e0b870bb8d74
SHA256b22160374b5fa88e4762629378b5346a908df9a61ee01ddb9e3e08ce7668398d
SHA512586388533642fcae34b8d4296e3eedfec25425117d031480e31e387465bd725d156dad7c1c738987aa2c0f12d226a4684aa8ce5c2aea3ee00ecddc1ad62f9dd3
-
Filesize
988KB
MD5ab39fcbaa14fda6d91437d4a72a0c04e
SHA1f3c2e58760d56842d534622ce896d040321fa992
SHA256a8fd3477293a9d3c365b6962d8514e1900841eed9f97635f4aa4111952f6d8db
SHA51207e1045c405e37ab309e2e9bdb1d3e6fef6b482562b5f168afd176d69b30c289bb60a7c6499212af63b372626f6a59785133dbd64238bf72abc770b1f013763b
-
Filesize
992KB
MD580bc03c11ed6892cbc362a9cfeb69287
SHA1e8bb21d2281117b9649ddcc1e132893e12809c97
SHA256d6045c88ee38f96bc6df9fbd1ed4f15f2d48706dc94b25d38ef8d843c42350a0
SHA512994a48229cdce3f0821c7c7215e9b952546bfc8a365c3d423e0743149c00902c1752d365b5a21657b37df0e9ed366f68627fc71b1628b1eb19ca609b7517fe80
-
Filesize
972B
MD556714a62f6d2e08e9854aeee2a78e579
SHA10df16208796768c1387978bc8409e45c4c52980a
SHA25644c53cff3fe3bcb3c7388ea85b158a8b46462d7733eb1c3ae98b7ec3710cceff
SHA512d1f63d1cdb5aa1d61dfbbfc66bec3ddcc9e7aa9749bcec6f218e20e6b6514ddaa1f7679619d555813945a302827d956dc9900f00a6f170f0aa21079ac35f4c8b
-
Filesize
272KB
MD53bcb70da9b5a2011e01e35ed29a3f3f3
SHA19daecb1ee5d7cbcf46ee154dd642fcd993723a9b
SHA256dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5
SHA51269d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df
-
Filesize
676KB
MD5b918311a8e59fb8ccf613a110024deba
SHA1a9a64a53d2d1c023d058cfe23db4c9b4fbe59d1b
SHA256e1f7612086c2d01f15f2e74f1c22bc6abeb56f18e6bda058edce8d780aebb353
SHA512e3a2480e546bf31509d6e0ffb5ce9dc5da3eb93a1a06d8e89b68165f2dd9ad520edac52af4c485c93fe6028dffaf7fcaadaafb04e524954dd117551afff87cf1
-
Filesize
206KB
MD525d284eb2f12254c001afe9a82575a81
SHA1cf131801fdd5ec92278f9e0ae62050e31c6670a5
SHA256837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b
SHA5127b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
988KB
-
Filesize
992KB
-
Filesize
28KB
-
Filesize
992KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB