dridex | hxxps://ankltrafficexit[.]xyz/trafficexit | Triage

Sharing

General

Target

https://ankltrafficexit.xyz/trafficexit
Sample

210910-a7538ahad4

Score

10^/10

dridex 10111 botnet discovery evasion persistence trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

104.152.111.198:9676

92.247.29.75:10172

133.242.136.130:8194

rc4.plain

rc4.plain

Targets

- Target
  
  https://ankltrafficexit.xyz/trafficexit
Score

10^/10

dridex 10111 botnet discovery evasion trojan persistence
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Blocklisted process makes network request
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Program crash
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

urlscan1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

dridex10111botnetdiscoveryevasiontrojan

behavioral6

dridex10111botnetdiscoveryevasionpersistencetrojan

behavioral7

dridex10111botnetdiscoveryevasionpersistencetrojan

behavioral8

dridex10111botnetdiscoveryevasiontrojan

behavioral9