dridex

Resubmissions

06/08/2020, 16:20

200806-ldv53k5z82

14/07/2020, 05:12

200714-djyygf591a

Sharing

Copy URL Twitter E-mail

General

Target
DUI70.dll
Size 1.2MB
Sample200714-djyygf591a
SHA256 1bc4755b2828092f30c53c4099d2a1b118d1a68686a82b7c11ef12c6ae93f8d4
MD5 ca7f847ac49ea5ec058b9455bacbb326
SHA1 9ea5760c8d7b2f1a479901677338e487e62aaad0
SHA512 5e57d36b700f030c977213899b2d5e4421abcaf54a41ccb336067e52f779066916b58ff1c81441be8c4e69240106569d40371b6ba862e6d89cbeda1cc65d6818
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Targets

- Target
  DUI70.dll
- Size 1.2MB
- SHA256 1bc4755b2828092f30c53c4099d2a1b118d1a68686a82b7c11ef12c6ae93f8d4
- MD5 ca7f847ac49ea5ec058b9455bacbb326
- SHA1 9ea5760c8d7b2f1a479901677338e487e62aaad0
- SHA512 5e57d36b700f030c977213899b2d5e4421abcaf54a41ccb336067e52f779066916b58ff1c81441be8c4e69240106569d40371b6ba862e6d89cbeda1cc65d6818
- MD5 SHA1 SHA512
Score

10^/10

dridex botnet evasion loader persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Loader
  Detects Dridex both x86 and x64 loader in memory.
  botnet loader
- Dridex Loader 'dmod' strings
  Detects 'dmod' strings in Dridex loader.
  botnet loader
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Dridex Loader

Dridex Loader 'dmod' strings

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks whether UAC is enabled

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2