Resubmissions
Analysis
-
max time kernel
149s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
17/02/2025, 22:37
General
-
Target
The-MALWARE-Repo-master/Banking-Malware/Dridex/Trojan.Dridex.A.dll
-
Size
628KB
-
MD5
97a26d9e3598fea2e1715c6c77b645c2
-
SHA1
c4bf3a00c9223201aa11178d0f0b53c761a551c4
-
SHA256
e5df93c0fedca105218296cbfc083bdc535ca99862f10d21a179213203d6794f
-
SHA512
acfec633714f72bd5c39f16f10e39e88b5c1cf0adab7154891a383912852f92d3415b0b2d874a8f8f3166879e63796a8ed25ee750c6e4be09a4dddd8c849920c
-
SSDEEP
12288:2oXYZawPO7urFw4HLLDOeLSwg4ULeHOuCqA8:2oXYFIuh5HjhSwiJ8
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Drops file in System32 directory 2 IoCs
-
Modifies registry class 10 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
-
Suspicious use of WriteProcessMemory 38 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Banking-Malware\Dridex\Trojan.Dridex.A.dll,#11⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\SystemSettingsRemoveDevice.exeC:\Windows\system32\SystemSettingsRemoveDevice.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\Qhq2.cmd1⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\gbr.cmd1⤵
- Drops file in System32 directory
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\bEJFiSb.cmd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Create /F /TN "Yxsjo" /TR C:\Windows\system32\lOapy\printfilterpipelinesvc.exe /SC minute /MO 60 /RL highest3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks.exe /Query /TN "Yxsjo"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks.exe /Query /TN "Yxsjo"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
628KB
MD5a4cf0afe5eb12d1fbd2d84b5b7f04d14
SHA1f2b39d5a31ca2567ac5837b6840fa47f76d7d04f
SHA25608cd4c85abe6862f57ade1039bb44e546110c72a396510854aa084f964435533
SHA5128d6cf390fb451c77ac85600167c97daa8af67d195646b64c24b8198b25c12fa634163bab2240d23ef9d93ef7892929907445331a6fe7d96826c2e4aadb194b4b
-
Filesize
246B
MD5db32205553c26d0b25591f5688e9d9ef
SHA1321170950adf2bf65cc8c45883f40adda6cc28a4
SHA2569f38e467a426aeb12a96ac4a152b4d2ac42d01cda5a6c14e72cb19e1deb10053
SHA512357eb22cae83af0e8bd421cc351ca40543291c77a45b2f843b8840e5619d64af84ca92c36298a866326ddc5545793a944fab5d17a349cdff7566de1f3002969f
-
Filesize
137B
MD5ac15da188f064300b08e31944095c080
SHA198d4fddefe22e69d15a7c40aa7618a58de0b999c
SHA2561cc5268580dfca855eff2ce6d626a64322b38a0f047545b2dc65b49a00859feb
SHA5125ae3dac4b6d4c19c2734e1c9c0f3543b2b4ae587054efcc43682085fcfd5b8d751aa3b4ce82de8cf54cfe5aa907579adace5707a603ed722d8b935bd4408bb4b
-
Filesize
209B
MD5d88487550e5b1f8390903b739a0d4bfc
SHA1a71bb3b4966b5471a2ad5669bff063d52ad4b098
SHA25659f8dc37ec154886c0b7a8b113b0820a9f63b98a341ef82f05b07e0eecbf4501
SHA5121e8023b02e6ac5fe8981ef7d54ad78f9a62748b843ef934bb6071d64f4b7d168e9093f0c98d058e0dd1312fde54386797988e02a616c40ac035b1deabaad8671
-
Filesize
908KB
MD5d9c9039069209ce112d3e0c8007a59c5
SHA142bf56a89dc4a1aafe4b34da0dd7bf33af785d37
SHA2566830fd58c3a1cc0e3d0869c7c93b8726f47f51ded7143bce78b21adebe35d879
SHA5126c2bc13d17e31bc21cb8809e825d958c2d96ed5aeea4012dcec5fe9b5d26907ae5db12c0eba08ecad8e608d6691dffef96b1caf01160687290d7c3816625e3ea
-
Filesize
994B
MD5ba5aacc3c6775eb385e743f8097ff2a6
SHA17710b3b03ebc3b668638149fca867ea2b9f2452c
SHA256b8b7b5a3b9c967993ea7790484259ca14a93943b81e4ef2a8aad2182f5aded43
SHA512f668947ceb78589ad31f2e1e5dd01fa32b0aa5483af7a70b22926e3dcb049a404ff817c19dcf94704ba53f0c4a5c36212f931101b0e18f3d2610783e7e99cb6c
-
Filesize
39KB
MD57853f1c933690bb7c53c67151cbddeb0
SHA1d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6
SHA2569500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d
SHA512831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
64KB
-
Filesize
628KB
-
Filesize
28KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
4KB
-
Filesize
628KB
-
Filesize
628KB
-
Filesize
28KB