Resubmissions
Analysis
-
max time kernel
150s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
-
submitted
17/02/2025, 22:37
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 9 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 57 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\javaws.exeC:\Windows\system32\javaws.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\97k.cmd1⤵
-
C:\Windows\system32\wusa.exeC:\Windows\system32\wusa.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\CNl.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\eventvwr.exe"C:\Windows\System32\eventvwr.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gSffju.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Fvvls" /TR C:\Windows\system32\yrqdf\wusa.exe /SC minute /MO 60 /RL highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Fvvls"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Fvvls"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
235B
MD531d01f63571e442d1816527c1c3c6ad5
SHA1828b8f98705f1ec31d33e4f838c0db3e6ca7dcee
SHA256e3b61fddcca00e2927084518ba97f60751afcabc422bf1fa6aba0f990dd8e1c6
SHA51276fec6e00ac8d13bcf42c7d0ddd1fc584843f91b348162fc0ca2112a0dbec0043e52e9c9a1508bccf0701dfa039af173e044d9553e9c9a98fa73c988df47899b
-
Filesize
195B
MD53e3f98a2b64de4bf107d3dbddb468f57
SHA1d2ec7c90e22d81ac455debdc2cfd7840b05fa4e3
SHA2562f52d026a8d67f58368f91610dbdae80b5081fb82089c33a3d035e3e30bdba5a
SHA512b796b64f1b9877d73b9326114aca95928e07228f84393553b5b7bdfb6199da60c67c7541efe6abff893ed23a5b423b8b07fb5209466790fe402e2499f42792a3
-
Filesize
119B
MD53ac81e1f6e68bedc4ae629164dad5bc5
SHA1a0a84461ab27621123dd20cdfd9436b2413508ba
SHA256ae2e0fe3c421b0046af1b1ceaf8e5a13a6beb1343bf58f35d745d8713d5d3b9e
SHA5121fa5ac8064817d389652672065e7d4b12cd2bd703f335bc06ec39f8b400c329718c6de2014c46a6c46df7e29a44fbffffd0219c7c7e13f2bad2fe33f5498682a
-
Filesize
628KB
MD58442d5d45d2bdc15fd4b04639d1f35ac
SHA1c47a8e4de801e39478023123bcb1fbae012e1bc4
SHA256b001d3c130f416be910f4bc1f523457d48ed7aa886fb4d83f041658ad93c33bf
SHA512995c71d36b96c58de90094ec329979f115cd6220b439daaa68eada05d06c23013f1faa90491155ca587988f8776cbdab5232a3d7dadd23d2026fc1b969c6abe8
-
Filesize
628KB
MD57dcea9cc58a85910c71a78eb8bc5483c
SHA131065803ef56b42d06493174330e49c17d4f688d
SHA2564caad9c94e07ccbba02f9bec0bc287bbb741cfc3eb88feb1a14fcddac1ee4885
SHA5122053a7ec25f9969f6a42f08bf2610e0af80a96f147e95e62fe56207160f27f7d6c4c3bb77d5aaec0dd156b592ffb88ff49a652bb11909f77e5e09470981ef2ff
-
Filesize
880B
MD5508ace1e1526c8030becacb6077963de
SHA1c400afd4ce3f9b56891fa607149089189a48754e
SHA256e886e38b530ec48226a4d7530aa61718b061f1f12e8eb3e923ea4fcd0c74c0bf
SHA5128d2ac93acc1f7c4c624f946ef62dcd7710a26c55430229626ddc656d8a0f4d67c007ebddf1dde8ae63b06d02565ce16314fd8631077edab398e8617aa10561eb
-
Filesize
312KB
MD5f94bc1a70c942621c4279236df284e04
SHA18f46d89c7db415a7f48ccd638963028f63df4e4f
SHA256be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c
SHA51260edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
28KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
628KB