Extracted

Extracted

• • Target

    Information_219488309.doc

  • Size

    234KB

  • MD5

    ee1d7753232b3855e6f631359d6bdd8b

  • SHA1

    ad5b90796f39c016328c90647d47a3f96334843a

  • SHA256

    59b1087ec423c56cba3ca5ef050b8f86a9fb22ddddcf096ca6d92363efaabe2f

  • SHA512

    f86179dc671ad87370370533a7924e27ea2211e5f03fe37653d2b3eab83c514f3a54dfe4697590b684d6314ab727f7aedeb5f98d3dfedfddb620522fbc4e26af

  Score

  10^/10

  dridex10555botnetdiscoveryevasionloadertrojan

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2