Extracted

Extracted

• • Target
    Information-822908953.doc
  • Size 117KB
  • SHA256 d2bc5e480daba7368064d7de34a53077e968dafc86084c87191c5c3d2fb7c444
  • MD5 59b5d3179a962efa890e2df17aaf31d1
  • SHA1 52b0231b64030049d61096bd2bb872ab89ac7e55
  • SHA512 4bbb5fbd99e9ae35f690dcc710d8ba168cf5361fd4857f5b9b341185834a9d1e19f641a47cf6ea18366d6f2d13e1ce457b53c12f9264b9da5fe38d02b1a29432
  • MD5 SHA1 SHA512

  Score

  10^/10

  dridex10555botnetcryptonediscoveryevasionloaderpackertrojan

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • CryptOne packer

    Detects CryptOne packer defined in NCC blogpost.

    cryptonepacker

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2