Resubmissions
22-10-2024 02:07
241022-cka1nssfkj 10Analysis
-
max time kernel
150s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
22-10-2024 02:07
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 10 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 22 IoCs
-
Suspicious use of WriteProcessMemory 36 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\CloudNotifications.exeC:\Windows\system32\CloudNotifications.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\FcHDo.cmd1⤵
-
C:\Windows\system32\Netplwiz.exeC:\Windows\system32\Netplwiz.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\MI8WE.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\7d0.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Tvbzwtfuekyqj" /TR C:\Windows\system32\4zWi\Netplwiz.exe /SC minute /MO 60 /RL highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Tvbzwtfuekyqj"1⤵
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Tvbzwtfuekyqj"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130B
MD58c44431d585b78ccba138bc634f6ba0b
SHA157d38b3646bbbaad5a73b161c63ce1d98e8d68bb
SHA2569421a6b51e4cda411d20c795c99767111dd3bd5f95d5127f8bacfc66e7e0116f
SHA5122743bc6d766e164b7fd5eca5fc4d5295293a24d4b72e76ae8f876b0899b86207fff521dedf92ebab6d6820ab5e0b6063bfd9a6b25f59a24af313341c4e504bbf
-
Filesize
628KB
MD56bb00f93a5ce567b8eba9b34d3279450
SHA149e53839088c40bc83fc60e6741ce025f3a00c45
SHA256f6ce701e5bd29bd282580364988806be99be6c577746dd357fc748c3bd32d36f
SHA512ad1d37fb7f25db57f7675ca28ad297b0902edfb6adff5f2ae150f69f5ee13b2dbc72606fca01286beb7ecf2f73aecdad2f09fc8b950ad5d4789605f4e943d519
-
Filesize
245B
MD5529b4d783b8089e21bd0b526d8640ac1
SHA1ef4cc71e0b3c30037eff422a5b4ab7cf2a3042a4
SHA25666582ea6b373bad52569e42f57ef8a378255afb6b8f3697f039d0db3048386c5
SHA512b54adc2f913ca070102d6cdbad6f0368684a8041758c7479c7fd968698106e0270ddbe839fc1cacb540c7e5b99ed6a7bbfcee76817cf83fd5724ec7de55341f1
-
Filesize
196B
MD538eb3908f03b747c1e48e34a3e0b9a06
SHA1fdf5994c8423f19a40c77f3dde3e2421be4e806f
SHA2567db69ba5557860a4e473190c59d2b52d46ef436159f02217b6bb80fa1e7a344c
SHA51282c9482d5bd8b1c260ef3fea80d31057cdd236addf853e55f227f2b73f611675d61d8742f5b8cc4e82789cfbf7bc217fa18fb5b2f7f9c6c43b42cbda57be4cf3
-
Filesize
632KB
MD55b6ec89d971297c68ae7b52bfa288fe9
SHA1e6efb1f9681b9a80a2c7ea53b8b7021eb231bb62
SHA25656a84ecb9adc89e064837c258f275b06464071641ebed45aa3c6ef7d8e383ba1
SHA5121b23ffc5fb9b2c30d3acfc034f39d79dd879c3f5e619aecc8ebab7f7d092cb6b0c16e726304c0819dd3cacefcd1c1ab74beac7e306cdacbbac264630af7d8104
-
Filesize
964B
MD5a1d2524b7b75ed3c808ea2745b3411db
SHA12289ded9a29260a6fd401f49aa7b4137cf8625b4
SHA25617636a4ad93736c8a037291c01794a6e4c410aa1d4ad9751c72c54dafa418925
SHA512cfce760778599a80333939674e50a787f85ab47adc6596d84b9400306d5bbb14700c086b153f1e6fc9127e4915d5f41f63a0ca9b9ccb63ee8985c74b7ec09198
-
Filesize
59KB
MD5b50dca49bc77046b6f480db6444c3d06
SHA1cc9b38240b0335b1763badcceac37aa9ce547f9e
SHA25696e7e1a3f0f4f6fc6bda3527ab8a739d6dfcab8e534aa7a02b023daebb3c0775
SHA5122a0504ca336e86b92b2f5eff1c458ebd9df36c496331a7247ef0bb8b82eabd86ade7559ddb47ca4169e8365a97e80e5f1d3c1fc330364dea2450608bd692b1d3
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB