Analysis
-
max time kernel
119s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 17:22
General
-
Target
Trojan.Win64.Dridex.ABM.dll
-
Size
984KB
-
MD5
5b4ed52afad791ec0dc42503eb380110
-
SHA1
51da3175f1952b77a4cbe7d5f25651cebf663d13
-
SHA256
b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2
-
SHA512
49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac
-
SSDEEP
12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ABM.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\Dxpserver.exeC:\Windows\system32\Dxpserver.exe1⤵
-
C:\Users\Admin\AppData\Local\MnrlwK\Dxpserver.exeC:\Users\Admin\AppData\Local\MnrlwK\Dxpserver.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemPropertiesHardware.exeC:\Windows\system32\SystemPropertiesHardware.exe1⤵
-
C:\Users\Admin\AppData\Local\wPD\SystemPropertiesHardware.exeC:\Users\Admin\AppData\Local\wPD\SystemPropertiesHardware.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\spreview.exeC:\Windows\system32\spreview.exe1⤵
-
C:\Users\Admin\AppData\Local\LNl7\spreview.exeC:\Users\Admin\AppData\Local\LNl7\spreview.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
988KB
MD5527bf86494ba1dc8d0710e1eb1d8dd2a
SHA1ec181a3c817e06f62a4604d34ef923b341f958ae
SHA2568b93103b23387a7e80f4c260a6428b84f501010c27bd7be2e96984f665f65a79
SHA51233e61e544e828f7341031ad78f547ec3ce2554724e3ab23386307a8c796eff826b95c7377f6273b409e9a51f23838d7ef3bfd529a42d685c6b6d62fcc79d8d93
-
Filesize
988KB
MD51bab1e11e6c2108ce09f919739842144
SHA1f5667691760c49d9d51c40e7af67e292a1de13c1
SHA256e2f80334a2dc28525aa87cd2d710a60f1cc1a159281ff9a723ed365689a1cd5d
SHA512a045618faf2d2fc31ed0a22c7bbe1c98b53296311c424fe79fa64c5c77810aa3a122000e716c17fe688dd012c2454f92b2fa82d52d4790cb40e60d016623c51e
-
Filesize
1KB
MD538ce5179dc4f33a192ec568dee47e126
SHA1ddd076852aae9836b36ced6bb23127f2fee36e65
SHA256e3bc18706a5b3b8901185f142c5bb9065526ac114a4cd4af4e7815c4fadd6224
SHA5129d5e384ec507db800326d1466eb4ea5dd533100520abf48e67fa75ecdef4df95f51cef382652ff8bfde5f082e53ac107ce93dbe7f4e66e194152ec72c6d69f70
-
Filesize
294KB
MD5704cd4cac010e8e6d8de9b778ed17773
SHA181856abf70640f102b8b3defe2cf65669fe8e165
SHA2564307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208
SHA512b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee
-
Filesize
259KB
MD54d38389fb92e43c77a524fd96dbafd21
SHA108014e52f6894cad4f1d1e6fc1a703732e9acd19
SHA256070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73
SHA51202d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba
-
Filesize
988KB
MD53e2a344261f077b78ccc0050901deaad
SHA13844bbd8b428fa0dc1c34fc5ea26b271595d9358
SHA2560abfe5257646e0ea4134298467a6e9b26d26cb51893b526d6b2802492d87ca08
SHA51237b744b6d1639b6839e0cce864887244f910cf9cbeca0178cb56f8a4d4768b2dd5dcb96c5789e74e14ce357a69446e2f37477586e4b5f2c4933572f07fb32749
-
Filesize
80KB
MD5c63d722641c417764247f683f9fb43be
SHA1948ec61ebf241c4d80efca3efdfc33fe746e3b98
SHA2564759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2
SHA5127223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
988KB