Overview

overview

10

Static

static

347d827101...58.dll

windows7_x64

10

347d827101...58.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    347d827101bbb1fc114fe06e705670046350338683e3cea6643ab55b9e0f6558

  • Size

    796KB

  • Sample

    210930-n5sl1aheb4

  • MD5

    08ab2257c2178ced9a295c898358c802

  • SHA1

    b1dcda430e56360b712ee0934331922929d4d69d

  • SHA256

    347d827101bbb1fc114fe06e705670046350338683e3cea6643ab55b9e0f6558

  • SHA512

    78142541a4dc5c22ccc8fc28198d4bd8f040e1eebd1c4208ef9301f074885eec7b6ba0b89798579d188214f07bf130aa97a8c99d47b90cd7dd001564f1b9975f

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      347d827101bbb1fc114fe06e705670046350338683e3cea6643ab55b9e0f6558

    • Size

      796KB

    • MD5

      08ab2257c2178ced9a295c898358c802

    • SHA1

      b1dcda430e56360b712ee0934331922929d4d69d

    • SHA256

      347d827101bbb1fc114fe06e705670046350338683e3cea6643ab55b9e0f6558

    • SHA512

      78142541a4dc5c22ccc8fc28198d4bd8f040e1eebd1c4208ef9301f074885eec7b6ba0b89798579d188214f07bf130aa97a8c99d47b90cd7dd001564f1b9975f

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks