Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
16-09-2024 17:22
General
-
Target
Trojan.Win64.Dridex.ABM.dll
-
Size
984KB
-
MD5
5b4ed52afad791ec0dc42503eb380110
-
SHA1
51da3175f1952b77a4cbe7d5f25651cebf663d13
-
SHA256
b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2
-
SHA512
49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac
-
SSDEEP
12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ABM.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\osk.exeC:\Windows\system32\osk.exe1⤵
-
C:\Users\Admin\AppData\Local\mPIJ\osk.exeC:\Users\Admin\AppData\Local\mPIJ\osk.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\BdeUISrv.exeC:\Windows\system32\BdeUISrv.exe1⤵
-
C:\Users\Admin\AppData\Local\XRU\BdeUISrv.exeC:\Users\Admin\AppData\Local\XRU\BdeUISrv.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\systemreset.exeC:\Windows\system32\systemreset.exe1⤵
-
C:\Users\Admin\AppData\Local\dvsMbW\systemreset.exeC:\Users\Admin\AppData\Local\dvsMbW\systemreset.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Accessibility Features
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD58595075667ff2c9a9f9e2eebc62d8f53
SHA1c48b54e571f05d4e21d015bb3926c2129f19191a
SHA25620b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db
SHA512080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88
-
Filesize
988KB
MD5ff2e345085e61b1f62762d78b2bbfbbe
SHA1a5fc0f8f5e7219d72ed2e1c2c6ab38cc01ae4466
SHA2569f4b767ac245ec4dd206126a676f0d70d3e5200945ecac3b64ac1179bee11e83
SHA5125a8f1216f5570136d19c4fc33bcd9b0a5d92643311fdfc60830fe93625fc430d954dd74f04838d562202c5f16b7d378da7ab2ac05b9ecb401fd6731dda592610
-
Filesize
1.2MB
MD5dfc429e7da62fb2a4098b5a8f5dadd3c
SHA1f0121daa20674da20e8e9163e6ac81ca190c8778
SHA2564d3e13ba76c4523a06bf00ba5455f1b9d9561f07e5613a7d025089e4447eb97b
SHA51219c65727d3471827057f53a840116954d4ff1d472cc5f578a83de924a355d6b5609f402ab903645933e81a7d6541020c468df48f95105018f2e104334e3e857b
-
Filesize
508KB
MD5325ff647506adb89514defdd1c372194
SHA184234ff97d6ddc8a4ea21303ea842aa76a74e0ea
SHA256ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad
SHA5128a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868
-
Filesize
988KB
MD54d3f956033648d6922382fb6e21233f7
SHA1f5b27a33236be3107834c9216f03db9f7e20b6b4
SHA25626752e739a9bd4a5ac9c09ddcf7dedc4e07c9d7f055ef0a86f25366c9a778e81
SHA5129c20269badb741ec481ef0568aee999167a189af31cbced6b2956c5a85c79e946a1c5c887066138e34149ed15b918ea52dc4d7f76d19757c922915b91f613ff8
-
Filesize
638KB
MD5745f2df5beed97b8c751df83938cb418
SHA12f9fc33b1bf28e0f14fd75646a7b427ddbe14d25
SHA256f67ef6e31fa0eaed44bfbab5b908be06b56cbc7d5a16ab2a72334d91f2bb6a51
SHA5122125d021e6f45a81bd75c9129f4b098ad9aa15c25d270051f4da42458a9737bff44d6adf17aa1f2547715d159fb621829f7cd3b9d42f1521c919549cc7deb228
-
Filesize
1KB
MD5ce9a0511885cd069f18c02649aa483ef
SHA1d47a08fa13bebac1f721289facd5b428f1eb8ed7
SHA256acd252675cbbbecb46f06e928deef7443d17e397be52918eac2e802eee309c21
SHA512b6f9ab4082ed196026a6a24a1263152ac6302f7d8f8b488e95cf0c99099a0f6358101a1268059bbed8955ba05effdb264046100f67d9b645ff8930595cde772a
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
988KB
-
Filesize
988KB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
988KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
64KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
28KB
-
Filesize
984KB
-
Filesize
984KB
-
Filesize
4KB
-
Filesize
4KB