Overview

overview

10

Static

static

decrypted_...in.dll

windows7_x64

10

decrypted_...in.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    decrypted_bot_2c0b93cb34660f8c68ab9e9eae6bd9d4.bin

  • Size

    830KB

  • Sample

    210121-y9vm4g66r2

  • MD5

    2c0b93cb34660f8c68ab9e9eae6bd9d4

  • SHA1

    5fb68d1c2050e82110914ab57f33e32986220a81

  • SHA256

    bf92d2153b239950b67dd65d31ce2727414a7cff206b09b5b3b5848304239ee4

  • SHA512

    96278319d583a9ddc6acbe7fdc1d23855cc5a82205dc2a344a67737c8177c706b3dc52e6dbb42831c42ea96e20aa0ec9923eac0d3a5694e5e84cdeafa8166131

Score
10/10
dridexbotnetevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      decrypted_bot_2c0b93cb34660f8c68ab9e9eae6bd9d4.bin

    • Size

      830KB

    • MD5

      2c0b93cb34660f8c68ab9e9eae6bd9d4

    • SHA1

      5fb68d1c2050e82110914ab57f33e32986220a81

    • SHA256

      bf92d2153b239950b67dd65d31ce2727414a7cff206b09b5b3b5848304239ee4

    • SHA512

      96278319d583a9ddc6acbe7fdc1d23855cc5a82205dc2a344a67737c8177c706b3dc52e6dbb42831c42ea96e20aa0ec9923eac0d3a5694e5e84cdeafa8166131

    Score
    10/10
    dridexbotnetevasionloaderpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks