Overview

overview

10

Static

static

ec089cbe28...72.dll

windows7_x64

10

ec089cbe28...72.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ec089cbe284c5a1297a9a4fbbfe11fca160b09140072b67a4b556931119e2c72

  • Size

    2.0MB

  • Sample

    210915-jftqjsdbfn

  • MD5

    1f87f8356cb8da7291397bdedb616d62

  • SHA1

    c94d9e204cd92b18012ba8a1da2bdd650b7c5809

  • SHA256

    ec089cbe284c5a1297a9a4fbbfe11fca160b09140072b67a4b556931119e2c72

  • SHA512

    9fadef2951dd4ffc02900b9baeaa8c4ee343d0582d338ae119d29268c196dee121b6d4708f0a1844f487c6750416a8030edfda0a8bd85dd80225e7bc2a23f150

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      ec089cbe284c5a1297a9a4fbbfe11fca160b09140072b67a4b556931119e2c72

    • Size

      2.0MB

    • MD5

      1f87f8356cb8da7291397bdedb616d62

    • SHA1

      c94d9e204cd92b18012ba8a1da2bdd650b7c5809

    • SHA256

      ec089cbe284c5a1297a9a4fbbfe11fca160b09140072b67a4b556931119e2c72

    • SHA512

      9fadef2951dd4ffc02900b9baeaa8c4ee343d0582d338ae119d29268c196dee121b6d4708f0a1844f487c6750416a8030edfda0a8bd85dd80225e7bc2a23f150

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks