Overview

overview

10

Static

static

Dridex.dll

windows7_x64

10

Dridex.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Dridex.dll

  • Size

    672KB

  • Sample

    210122-llkshp4gcn

  • MD5

    5decc1ceb1b5a1a1a26a7049ab860f67

  • SHA1

    02219e55c686e80e405a8132cb0a4fb77bef3b4a

  • SHA256

    e84a6be9a0be2072e7cad77b66e433bcb87035dae75e86ca982d26fe37186458

  • SHA512

    3fb6cee0c6ab75ac53d0cd1cb6362e93d94d068e71df24feb699c318d47692e8752cfca4022c97e3675caaf821acf1aa5405cb738c148b85a7ae2343c315be52

Score
10/10
dridexbotnetevasionloaderpersistencetrojan

Malware Config

Targets

    • Target

      Dridex.dll

    • Size

      672KB

    • MD5

      5decc1ceb1b5a1a1a26a7049ab860f67

    • SHA1

      02219e55c686e80e405a8132cb0a4fb77bef3b4a

    • SHA256

      e84a6be9a0be2072e7cad77b66e433bcb87035dae75e86ca982d26fe37186458

    • SHA512

      3fb6cee0c6ab75ac53d0cd1cb6362e93d94d068e71df24feb699c318d47692e8752cfca4022c97e3675caaf821acf1aa5405cb738c148b85a7ae2343c315be52

    Score
    10/10
    dridexbotnetevasionloaderpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Loader

      Detects Dridex both x86 and x64 loader in memory.

      botnetloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks