Extracted

Extracted

• • Target
    Report-30673485738.doc
  • Size 97KB
  • SHA256 93a47f8cffdd7f69d020813a390ffcf3bf850a5e53d398feba160f8efd2b5c43
  • MD5 f39b9d872d9c988b01ab7ec0c91f17f9
  • SHA1 5884db4a94c4fb6e81481435566b25191ab578c1
  • SHA512 aad5ae5ff9c7659fd473077e69c335c454ee22f1347e08a4ca8408f9b2fc4664a785501d13da085c76323c934a02d41c8af9ec621be33337fec1da5e16134c97
  • MD5 SHA1 SHA512

  Score

  10^/10

  dridex10555botnetdiscoveryevasionloadertrojan

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Dridex Loader 'dmod' strings

    Detects 'dmod' strings in Dridex loader.

    botnetloader

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2