Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 17:16
General
-
Target
Trojan.Win64.Dridex.AKN.dll
-
Size
988KB
-
MD5
faa52775467027ecef5464835e81dca0
-
SHA1
7828dca05863145a3010264642e76ed54db422c1
-
SHA256
31876c7c1c30dead73141dc79176c60ed2c28448ff7b233196841eef03df891a
-
SHA512
8a45ee106468a7d634cf38b33168df6716f1f9dee47b70dbabb6e2abb225dee19c6fec9c7788f7a460297db947df2c5dd123e6577446c01ec317270aea2a2d95
-
SSDEEP
12288:rw4UXJosZXoyOBTHE0wGxk8LyYB8OpFpG0JrbEvSdYmZbvnMEfI:LUolBrtw4k8LL8OpFpG0JXHZrf
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 8 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.AKN.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\VaultSysUi.exeC:\Windows\system32\VaultSysUi.exe1⤵
-
C:\Users\Admin\AppData\Local\VV8DU\VaultSysUi.exeC:\Users\Admin\AppData\Local\VV8DU\VaultSysUi.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\rdpinit.exeC:\Windows\system32\rdpinit.exe1⤵
-
C:\Users\Admin\AppData\Local\qZk\rdpinit.exeC:\Users\Admin\AppData\Local\qZk\rdpinit.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\sigverif.exeC:\Windows\system32\sigverif.exe1⤵
-
C:\Users\Admin\AppData\Local\XeMx\sigverif.exeC:\Users\Admin\AppData\Local\XeMx\sigverif.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5f40ef105d94350d36c799ee23f7fec0f
SHA1ee3a5cfe8b807e1c1718a27eb97fa134360816e3
SHA256eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2
SHA512f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1
-
Filesize
992KB
MD52483c1e9d12b838bd953c3907a9815bf
SHA1a06a0e29528c14070e98da3e2c27c004acffddec
SHA256523b7369faaee7201eda6c3f59bec97a1829e2b78aa43b29027db5868f6a85e7
SHA5126b7c158d1bbb57a36ddf0f25457f7b2bf2caab840361e62cf5c97a645ea72ad2a7feadefd8102172bb53e129e446f7de7e24dc54ffac65725b9c97d070a2b6b5
-
Filesize
992KB
MD554e8879236772bdc10439ff3296128c4
SHA1baff78c54b713b66e5779559de72b2799cb7ff62
SHA256d5bb28524c1cee55e7391206ad43cd767b79551cec68dfadbfd62480d671f15e
SHA51205952cd20b558b43aa740231da59cc2bc86af6b7998a75accad4e8903540f053adec91d019aebff859ab4bdac8b3f98282b0916e4203cf1a69fdd4a5344741b6
-
Filesize
73KB
MD5e8e95ae5534553fc055051cee99a7f55
SHA14e0f668849fd546edd083d5981ed685d02a68df4
SHA2569e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec
SHA5125d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6
-
Filesize
992KB
MD5e4e7bfa48cba34d7b08d0539b9e9a3dd
SHA1b872970bc63f4f7ce5bb6e631e725078f69c8254
SHA2560354a7a77b7c487fdd5eb08940b267a43548fc405d07128efa780696b51bd905
SHA5128a6c3391fa922cd4c306ca87f28fd887a18cb381abed45a019735bb4295f58c8a458d8c2afd32bb6bc5561c71353b59a9896179abd7d5b3c030e18e3d8209a7c
-
Filesize
1KB
MD5f717011a80b1e32dea73b06b9604c240
SHA115c31b2be042d208b11ae037f146a2a4fcca843a
SHA256e9ee08c430e45663b89f2c9b95cce9e805189380ff9b0afc54152ed2c486d8bf
SHA512d8a2d30518ef1bbc58345ae48e2c985f61e8e823aec2fa8fcd0a72d0db0f51da4be1e2bfee9b630fb647fe67a80014100572153a4eceef19ab549f6733fc2cb4
-
Filesize
174KB
MD5664e12e0ea009cc98c2b578ff4983c62
SHA127b302c0108851ac6cc37e56590dd9074b09c3c9
SHA25600bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332
SHA512f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
4KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
992KB
-
Filesize
28KB
-
Filesize
992KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
992KB
-
Filesize
992KB
-
Filesize
28KB