🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Dridex


Vendor detections: 9


Intelligence 9 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5
SHA3-384 hash: 928a6bef4c45b64bcca7c55f6402f8f1afd91398f04afd07387431e2caaf59b9bdbc6eff16f2083191cf237f0691a96d
SHA1 hash: a0130161d06f6868489dbeb9ac91f60df66fc3fd
MD5 hash: a9bda392687bb9bd727edba0b29ee257
humanhash: march-oscar-black-lion
File name:7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5
Download: download sample
Signature Dridex
Create hunting rule
File size:851'968 bytes
First seen:2021-09-30 11:15:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c6b4c2eec8a93016c63563421e15f011 (66 x Dridex)
ssdeep 12288:hdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:vMIJxSDX3bqjhcfHk7MzH6z
Threatray 83 similar samples on MalwareBazaar
TLSH T1B405E094B677A1CAC4A76CF6EDF86D706A522CC3623047A1CE02D1461B751F4CDF2A27
File icon (PE):PE icon
dhash icon 44b2686938d8cc00 (67 x Dridex)
Reporter JAMESWT_WT
Tags:Dridex exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
143
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5
Verdict:
No threats detected
Analysis date:
2021-09-30 11:23:00 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dbd99c6e-709a-47b6-b22b-e3798c312ee2

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
DridexV4
Create hunting rule
Link:
https://www.capesandbox.com/analysis/193498/
Detection(s):
Win.Dropper.Dridex-9875456-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Changing a file
Replacing files
Launching the process to change the firewall settings
Creating a process with a hidden window
Reading critical registry keys
Creating a file
Creating a process from a recently created file
Deleting a recently created file
Creating a file in the %AppData% subdirectories
Forced shutdown of a system process
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Stealing user critical data
Unauthorized injection to a system process
Forced shutdown of a browser
Enabling autorun by creating a file
Malware family:
Dridex
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4482da4-5fec-4f2b-8752-848d43bd915e
Result
Threat name:
Dridex
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/861810
Signature
Antivirus / Scanner detection for submitted sample
Changes memory attributes in foreign processes to executable or writable
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
PE file has nameless sections
Queues an APC in another process (thread injection)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses Atom Bombing / ProGate to inject into other processes
Yara detected Dridex unpacked file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1430 Sample: Ue4F8xhriL.dll Startdate: 30/09/2021 Architecture: WINDOWS Score: 92 31 dlassets-ssl.xboxlive.com 2->31 33 api.msn.com 2->33 41 Malicious sample detected (through community Yara rule) 2->41 43 Antivirus / Scanner detection for submitted sample 2->43 45 Multi AV Scanner detection for submitted file 2->45 47 3 other signatures 2->47 8 loaddll64.exe 1 2->8         started        11 StartMenuExperienceHost.exe 2->11         started        14 explorer.exe 2 133 2->14         started        16 16 other processes 2->16 signatures3 process4 dnsIp5 49 Changes memory attributes in foreign processes to executable or writable 8->49 51 Uses Atom Bombing / ProGate to inject into other processes 8->51 53 Queues an APC in another process (thread injection) 8->53 18 rundll32.exe 8->18         started        21 cmd.exe 1 8->21         started        23 rundll32.exe 8->23         started        25 rundll32.exe 8->25         started        35 192.168.11.1 unknown unknown 11->35 signatures6 process7 signatures8 37 Changes memory attributes in foreign processes to executable or writable 18->37 39 Uses Atom Bombing / ProGate to inject into other processes 18->39 27 explorer.exe 18->27 injected 29 rundll32.exe 21->29         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5/
Threat name:
Win64.Trojan.Injexa
Create hunting rule
Status:
Malicious
First seen:
2021-09-28 21:25:00 UTC
AV detection:
32 of 45 (71.11%)
Threat level:
  5/5
Verdict:
malicious
Label(s):
dridex
Create hunting rule
Similar samples:
0592a33cc1d10ff6498f3f4390794960799f6fbf8868036a65f3d285163967dd
Dridex
12abffffa93c9a84516116b2fad3d1b0f6e471f703c444f7246721208e1d70f7
Dridex
36a6c2320d82f5e3b748ca1d78a7619096b98614f091905d4ee0d61a681f0de6
Dridex
42e780640ee233f66b212f13d9a8983241780a3dd2740990cddf0b66ae1468d2
Dridex
757cc285faf67d63af8af0729ffa2e319c8fc5c8f20a3f409387af7664d1d4f0
Dridex
7a8f958118a130fa685f946a4331f963976db7690786eb5e4bdb450095d715b6
Dridex
807f12238d1ff9667c31f44178796a63ce759c4ca78cd472f9975d0c753aebaf
Dridex
c94f7789215299282abe47ae342505234d4e8c46e1ab825f79ac1223078e6e1c
Dridex
ca59948cbaec960d7b31ff1239c58d169b50dec11e57ab6201754362bf71b5fe
Dridex
fd327dd15819f0bfde36fba8dcf0ccc44ad76341bd32d55f6c8ce49fb6feb898
Dridex
+ 73 additional samples on MalwareBazaar
Result
Malware family:
dridex
Create hunting rule
Score:
  10/10
Tags:
family:dridex botnet evasion payload persistence trojan
Link:
https://tria.ge/reports/210930-nc6cdshdd3/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Adds Run key to start application
Checks whether UAC is enabled
Loads dropped DLL
Executes dropped EXE
Dridex Payload
Dridex Shellcode
Dridex
Unpacked files
SH256 hash:
7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5
MD5 hash:
a9bda392687bb9bd727edba0b29ee257
SHA1 hash:
a0130161d06f6868489dbeb9ac91f60df66fc3fd
Link:
https://www.unpac.me/results/4cb8c50e-243b-4437-9cd0-ed502f66bb7b/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/7cd157bb4a28/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.72
Link:
https://yomi.yoroi.company/submissions/7cd157bb4a288f2f1eda8f3b1e8a6a2612817c19172edd04939624536fee7cf5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/193498/

Comments