Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 03:42
General
-
Target
Trojan.Win64.Dridex.ASFS.dll
-
Size
968KB
-
MD5
2f6f37b1fbcaef784678f6c7c28b0000
-
SHA1
a95e2e1be2d3ff1981431b0410d085c26f3cee23
-
SHA256
3f3ad389e9541bbce7ff09e031de4105c89ad468be01b7ef7310f189e2b98642
-
SHA512
00a7e7919324f165262a70fcdd581b68ce7ff8a7ced313b6f8ba8511f20caf2c002a8bdc803a21d5263fde986691112649653ecf6a4fe27bdaab9248cf16e197
-
SSDEEP
12288:LfJV6EzPTIzQF9mVz5wYacR/8HiFeQBsjgyvunuAoA2U3PxyWhD:LhVXu8mZ5racR/xFejmnuAD2U3Prh
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 12 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ASFS.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\t4U\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\t4U\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe1⤵
-
C:\Users\Admin\AppData\Local\cfW\mmc.exeC:\Users\Admin\AppData\Local\cfW\mmc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemPropertiesAdvanced.exeC:\Windows\system32\SystemPropertiesAdvanced.exe1⤵
-
C:\Users\Admin\AppData\Local\CQKHV\SystemPropertiesAdvanced.exeC:\Users\Admin\AppData\Local\CQKHV\SystemPropertiesAdvanced.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
972KB
MD58c035c3cf0cbc6cc559f9c09cf90c24a
SHA175fc70048df5b7243a5cfa2ce8609424cec55e31
SHA2567a5023790512324d3f47be5c0bd93b538fe445b79bf58650e3ab6f248b2bbb3d
SHA512059cd7d472f3776b52e93e7119a1eb12803fab94600cae4451b877eb162cac5223a6d709ba72b6e8af2e3ba55c98a09cb29e3973ade6dd4e186d15f8de968f56
-
Filesize
972KB
MD5b16886e853bb6e92152d2f29773701a1
SHA1508c15625d454b6f0d5cff162bd6a2f963c3c08f
SHA2567538fcc4b04442d222433e5a2102ae79b3003c495dbc970d19206a0e75f8fe06
SHA51207c332c868a6a9eba96d6c1a6f5585bcfc36e43fc62fd72115ad45a12b81132c5e7600c37cc32b201337a87ac40a3fd9979c33b0c01a3d2002519c52af25e103
-
Filesize
972KB
MD51f869867c1b34edc735bf992daf4ff56
SHA16e1501dedf2c74428a4e24c532bb10864ecf4df2
SHA25621fc84075ac2afd786e86e0bb31114c836af79cf1c665237f90d872cca780ceb
SHA5128f21593cea3762de35025f8c618a63fa3b068a3ae3f5dee1011c983264b993d130f2286fbb217982443daba52423e65aa1d1f7394e2138d75d4d3552484a2e3e
-
Filesize
1KB
MD537619cc1fb3b3c0b5080cc0a0d205833
SHA1e59d8baac0658fac763ce28a3ee198b9cf9b47bb
SHA256d7d88c746e72e30ff090b04a0cba0bcce66dee0e05fe990497c08bea20c5524c
SHA51217f6db7ca186d8a6a13e303130373f45d8c4c1d5b44f2d5e15340917fee749c6667f25dec8355089a3095191923c97375d2abdcce5af187abf1271d46149959c
-
Filesize
80KB
MD525dc1e599591871c074a68708206e734
SHA127a9dffa92d979d39c07d889fada536c062dac77
SHA256a13b2ba5892c11c731869410b1e3dd2f250d70ff9efd513a9f260ab506dd42ef
SHA512f7da9ce4c3e8aea9095fcc977084c042f85df48fca0b58fb136dfd835ce69b5b1e68f3c11eeb14c617ffcec7011ffc7e5d5a948f49dde653a2348b28e10adb72
-
Filesize
2.0MB
MD59fea051a9585f2a303d55745b4bf63aa
SHA1f5dc12d658402900a2b01af2f018d113619b96b8
SHA256b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484
SHA512beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
968KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
972KB
-
Filesize
972KB