Analysis
-
max time kernel
119s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
15-09-2024 15:07
General
-
Target
Trojan.Win64.Dridex.ABM.dll
-
Size
984KB
-
MD5
5b4ed52afad791ec0dc42503eb380110
-
SHA1
51da3175f1952b77a4cbe7d5f25651cebf663d13
-
SHA256
b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2
-
SHA512
49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac
-
SSDEEP
12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 8 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ABM.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\perfmon.exeC:\Windows\system32\perfmon.exe1⤵
-
C:\Users\Admin\AppData\Local\bLJ2vt\perfmon.exeC:\Users\Admin\AppData\Local\bLJ2vt\perfmon.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wscript.exeC:\Windows\system32\wscript.exe1⤵
-
C:\Users\Admin\AppData\Local\4XPLM710\wscript.exeC:\Users\Admin\AppData\Local\4XPLM710\wscript.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\AtBroker.exeC:\Windows\system32\AtBroker.exe1⤵
-
C:\Users\Admin\AppData\Local\qXH4\AtBroker.exeC:\Users\Admin\AppData\Local\qXH4\AtBroker.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD5a6f789064fc5be44d8340e5383d11b8d
SHA1e55842c1c6b1e3fc21ac8062f3456ca182d9f8dd
SHA2568a95f60a89bfa44d19c746dbc3694ddc4662cd6d5e250c288a7585dd885d6de8
SHA5122d4ca24b807abffa31534880a0c9a30e145532e992aadb364308ea762965a93b1efcd83c2105ea0ecc9d0fc3267926aedac4181782bb565a94fd61ea48e498e9
-
Filesize
166KB
MD5a47cbe969ea935bdd3ab568bb126bc80
SHA115f2facfd05daf46d2c63912916bf2887cebd98a
SHA25634008e2057df8842df210246995385a0441dc1e081d60ad15bd481e062e7f100
SHA512f5c81e6dc4d916944304fc85136e1ff6dee29a21e50a54fe6280a475343eccbfe094171d62475db5f38e07898c061126158c34d48b9d8f4f57f76d49e564e3fc
-
Filesize
988KB
MD54c01a83714de7c6bc1ff0d266fdb5fcc
SHA110733526e3b4aea7c735f6aea3400004666eca98
SHA2563f65d89f2f0615fecafcb603499b6c976cc093a082e8a38db3e37811efa59db5
SHA512b8c1d2137e74af021e2de92922eddcaed275083974ade1afe9caaaa1e7cb6c2d7ba32dad0d7f11a9597dedeea9aae67a517d1d01822e2e8078d6ccc13960cdc9
-
Filesize
177KB
MD5d38aa59c3bea5456bd6f95c73ad3c964
SHA140170eab389a6ba35e949f9c92962646a302d9ef
SHA2565f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c
SHA51259fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68
-
Filesize
90KB
MD530076e434a015bdf4c136e09351882cc
SHA1584c958a35e23083a0861421357405afd26d9a0c
SHA256ae7b1e298a6e38f0a3428151bfc5565ede50a8d98dafaa147b13cf89c61f2ddd
SHA512675e310c2455acf9220735f34fa527afe87dac691e89cc0edc3c4659147e9fd223f96b7a3beea532047aa0ebc58880a7010343019a50aa73ce69a038e3592024
-
Filesize
988KB
MD55c2d8377d8bda96a63999d752cd7399c
SHA1852f5c8f485422778021e5854508639aeaab3f1d
SHA25655df3ebefa5d583ea2b5fee937ab3f66e36b4e36bbdd69d018ab191ef6b9d35f
SHA51211d43b73528db33e6d32d4f0e2cff6f4a0ff197cb884cbce7dbaf9f3b7e2268d046ca02a81380436b76be083651f97ab903ebeec70a012ed3fe388cfe76d2d05
-
Filesize
1KB
MD5b588241b73970c4cb8f5d35e519f9451
SHA17d14064f27cfeed4f38082111e4e2302274bed58
SHA2561eaf608f3a4b51eb1eae63cc35565dfdc376722938a4f85596b5427ccce43e44
SHA512e663c3b2d6787d1b4b0b0a6766a2cc872ab33716f2c97561fb7a2c4b19bca4406fdf1b13378b626c684d63e680bac0e5263cfaa1d22db46dec53eb120b47fdc4
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB