Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
16-09-2024 18:29
General
-
Target
Trojan.Win64.Dridex.ASFS.dll
-
Size
1.8MB
-
MD5
0911f9a26ce4142acbb04da26b9d54f0
-
SHA1
6e443ef54eb8b28725f0717cba6ccdc03d66ba77
-
SHA256
98f5cbef3bae29cbc52bcb0224d5964f69ab793f2296a6954e68ffdf26636d8f
-
SHA512
bc42593e5dc3c2dd52f45ff292db1eab892cf53b158f3018e6a6e2795e47f01700c80b85b5297e9541c2c6e5a3317d5325d84f99b8b82ec3780f049350b9ece6
-
SSDEEP
24576:y6UQsIUK6eiyaJt2TlBuWA+ypYKLDGxaaxg1qpRai:nUQsIUK6eiyaJYTlBQ+mxH9au1eRai
Malware Config
Signatures
-
Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
-
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
-
Dridex payload 9 IoCs
Detects Dridex x64 core DLL in memory.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 7 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks whether UAC is enabled 1 TTPs 4 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ASFS.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\dccw.exeC:\Windows\system32\dccw.exe1⤵
-
C:\Users\Admin\AppData\Local\I01Ko00P\dccw.exeC:\Users\Admin\AppData\Local\I01Ko00P\dccw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\slui.exeC:\Windows\system32\slui.exe1⤵
-
C:\Users\Admin\AppData\Local\UweTWaB\slui.exeC:\Users\Admin\AppData\Local\UweTWaB\slui.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
C:\Windows\system32\wisptis.exeC:\Windows\system32\wisptis.exe1⤵
-
C:\Users\Admin\AppData\Local\MXo\wisptis.exeC:\Users\Admin\AppData\Local\MXo\wisptis.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD5a63b286fcd831bc0b9673a654eb33f6a
SHA114a224a2c21911f8ded3e328b1a5dccafc57d4a8
SHA25678ba08a3e4752071c4a11619e191bc14aea25bf552736f0909f11f24f64ec9b7
SHA512e2e79d743dc10eb20b5c67bd5b536cb11b37d4ef26a7136f8471997d1b2e7a8a576e4520075500b4618beadc30dfc3719dc401ec23ca6313d95fc24f615ac766
-
Filesize
1.8MB
MD529caa94f7df8448817dd7743717cee8b
SHA18eb78929a621fc4850bc0e41875ec73395f08e54
SHA2565cfd3dd8f7a3b72f491158678775bee1124f2b05aab73b60328bad8071fe631a
SHA5128da01c5fcd5255adbefba8422211dc1f35be6634377e7563d9a95e50839da112ceec184eebf7d78d423217bce8aa2068a77c7a2bb37c8bf6c1143c22e6a5371c
-
Filesize
1.8MB
MD5d4957d98e0898efb715b046f73288439
SHA15d7479e3f4c2be0c14018325954aaf88c44403c1
SHA256bcf9f076320c0c4c5717d6723636c0d942f6b27c650d1d203faf0db026b8b18b
SHA5122b36b629d480076443f34f3fed7014bc51dadb456894cf0758c9bcea58ccf8d56f3679c87d1e09bf0b6b5b6282937780a12161e19ab75326dd4240ba9d0d90cf
-
Filesize
1KB
MD5a9bf460e58a56f677d3df4a92dd8bcfb
SHA1868a182e316a2736f7201de816ada37ffc75db25
SHA256b43a214f0dfcb778b0d7d0b5c2117ad77d204f586752859d6142a69c9355c6ae
SHA51229c3b503d580d9ae56fd461d6f53c9ace573f21545cbe9786da9ff470505126d49e2446a18409e3e9ec03d123c9cd70e2e48f256da3be326ab3402bd5f4138e6
-
Filesize
861KB
MD5a46cee731351eb4146db8e8a63a5c520
SHA18ea441e4a77642e12987ac842b36034230edd731
SHA256283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5
SHA5123573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc
-
Filesize
396KB
MD502e20372d9d6d28e37ba9704edc90b67
SHA1d7d18ba0df95c3507bf20be8d72e25c5d11ab40c
SHA2563338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144
SHA512bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200
-
Filesize
341KB
MD5c5ce5ce799387e82b7698a0ee5544a6d
SHA1ed37fdb169bb539271c117d3e8a5f14fd8df1c0d
SHA25634aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c
SHA51279453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
8KB
-
Filesize
8KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB
-
Filesize
28KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
28KB