Analysis
-
max time kernel
119s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 03:42
General
-
Target
Trojan.Win64.Dridex.ASFS.dll
-
Size
968KB
-
MD5
2f6f37b1fbcaef784678f6c7c28b0000
-
SHA1
a95e2e1be2d3ff1981431b0410d085c26f3cee23
-
SHA256
3f3ad389e9541bbce7ff09e031de4105c89ad468be01b7ef7310f189e2b98642
-
SHA512
00a7e7919324f165262a70fcdd581b68ce7ff8a7ced313b6f8ba8511f20caf2c002a8bdc803a21d5263fde986691112649653ecf6a4fe27bdaab9248cf16e197
-
SSDEEP
12288:LfJV6EzPTIzQF9mVz5wYacR/8HiFeQBsjgyvunuAoA2U3PxyWhD:LhVXu8mZ5racR/xFejmnuAD2U3Prh
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 10 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ASFS.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Users\Admin\AppData\Local\iDkCgQY1\wusa.exeC:\Users\Admin\AppData\Local\iDkCgQY1\wusa.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SppExtComObj.ExeC:\Windows\system32\SppExtComObj.Exe1⤵
-
C:\Users\Admin\AppData\Local\Veb1y0\SppExtComObj.ExeC:\Users\Admin\AppData\Local\Veb1y0\SppExtComObj.Exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Users\Admin\AppData\Local\C5S\SystemSettingsRemoveDevice.exeC:\Users\Admin\AppData\Local\C5S\SystemSettingsRemoveDevice.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5bdb99351333b8ea56f0a79ddc7f5a052
SHA138cdac85627e3b448433d7064a63b307a3556da4
SHA256ca580c71d9974440d8243887c35e53c5c55ac8eabd23eeba41188bd9c6287f74
SHA512565e1f7c17db7e745b78f6c7ac2fdfde48640d0a24701e5e36f06ef9fe54bee5163dd37aae36b69a5f77ae0e033dd80e155e3b0a33e68c21637cb8a5a130c0bf
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
972KB
MD5dccfabce8d7feee57f080e4ee0672c03
SHA1620dbdd354185f6da3a27e936fa33402015252f1
SHA256697d609452883ad322097e74d04721cc477a1761b65fbc8b140a912874241095
SHA512f323b4bb437cf725ffb5dc5e8da8ff23350e43b398842d620f589cb4c7f3a77b1bee329c953caf22c7013b88c2f74f791b7c35777fe67f350dc38fdd26a6fe42
-
Filesize
559KB
MD5728a78909aa69ca0e976e94482350700
SHA16508dfcbf37df25cae8ae68cf1fcd4b78084abb7
SHA2562a6581576305771044f07ea0fef27f77859996dbf66c2017e938f90bfc1e010c
SHA51222bf985e71afa58a1365cc733c0aa03dabd4b44e7c6a136eb5f9b870db14470201b4ef88a19fa3864af6c44e79e1a01d6f8806062d9d4861ba7dac77d82074f1
-
Filesize
972KB
MD57ad0b9c3527bb0873bf704cff2ad2220
SHA1e2953c1d2815684dffb315272154de2326bc8d47
SHA256ed0d86cdf6f0e295943cbe5015759a310fa505d59a0f5ff2c4208cab03a3e137
SHA512fb28805c3b36ea526afe6134aa9827b2d7ba38cd5d18b8c282f00bf3ec2999d12d74742a848a32ebea3328891fa1af20d9f53c4deeeb7c72d125c904cf97f916
-
Filesize
309KB
MD5e43499ee2b4cf328a81bace9b1644c5d
SHA1b2b55641f2799e3fdb3bea709c9532017bbac59d
SHA2563e30230bbf3ceee3e58162b61eed140e9616210833a6ad7df3e106bc7492d2fb
SHA51204823764520871f9202d346b08a194bdd5f5929db6d5c2f113911f84aece7471c8d3bd2c4256119a303dbe18a0c055dbc5034d80b1f27a43744104544731f52b
-
Filesize
1KB
MD55c1faf7ba42ed8a748566168fce1fd6f
SHA19db29939c54e290b53729435a8d2b36d79d1936b
SHA2568f2984d7da0a71244528ca8c7a94b6a88519bf19a4106ed9aa51458b06696f4e
SHA512cce5e5f625bfc4b5e2bacd3ef4678a30568e444331c08cba5e2b2276a9c4cc691c78521ebe8779f8f7c4a7e75728ded9c776758e2881000ffaafae4163af0e73
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
972KB
-
Filesize
972KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
28KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
968KB
-
Filesize
28KB