Extracted

Extracted

• • Target
    Information#381141749.doc
  • Size 234KB
  • SHA256 52dc6da720ff69d8dea66a117fb1fd57e7db0366ec7f55b05cce18f6a3477cc8
  • MD5 e66571325545211f2e2df5e755b65775
  • SHA1 90ec8f973776074eba7df0aa36471677c875f585
  • SHA512 ccecf25f7ff400de1cb9e56f2f4fe3a29568214cecbd44a7ecf17ab91ffbd4de5a3834bcf3025ec5a6e694cdf049ed9004edae4424d52c5e91c0cc072ff2e441
  • MD5 SHA1 SHA512

  Score

  10^/10

  dridex10555botnetdiscoveryevasionloadertrojan

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2