dridex | hxxps://nawa-store[.]com/shopinside | Triage

Submit
Reports

Overview

overview

Static

static

URLScan

urlscan

https://nawa-store.c...

windows7_x64

1

https://nawa-store.c...

windows10_x64

Sharing

General

Target

https://nawa-store.com/shopinside
Sample

210709-8f2ps31z5x

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Static task

static1

URLScan task

urlscan1

Sample

https://nawa-store.com/shopinside

Behavioral task

behavioral1

Sample

https://nawa-store.com/shopinside

Resource

win7v20210408

windows7_x64

0 signatures

0 seconds

Behavioral task

behavioral2

Sample

https://nawa-store.com/shopinside

Resource

win10v20210410

dridex 10111 botnet discovery evasion trojan

windows10_x64

0 signatures

0 seconds

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

43.229.206.214:4664

37.59.103.148:4664

79.143.186.143:5007

rc4.plain

rc4.plain

Targets

- Target
  
  https://nawa-store.com/shopinside
Score

10^/10

dridex 10111 botnet discovery evasion trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Blocklisted process makes network request
- Executes dropped EXE
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

behavioral2

dridex10111botnetdiscoveryevasiontrojan

© 2018-2024

Terms | Privacy