Overview

overview

10

Static

static

9a4245ee04...db.dll

windows7_x64

10

9a4245ee04...db.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9a4245ee0429f775eea3dc26b694080cfa0d6a43f487cca54efeeae5b5ba89db.zip

  • Size

    502KB

  • Sample

    211015-2clvmsbeg3

  • MD5

    52c899c5e4444f2426564957bab785d6

  • SHA1

    cf8f04f331e6b550f424ece801376060a029172d

  • SHA256

    ea85e8cf4b7645bb3ca7889dec0479aa0d7c2f00687b78ca070e7f79be30faf0

  • SHA512

    8858d9d2782b8586bbc48f5bc62684d46f8132bc324a2d249ed76133454ca1dbc50e8754aedc3c80c6dadf467c22300a310ef23d38e4cec73e48a60c3b29ae05

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      9a4245ee0429f775eea3dc26b694080cfa0d6a43f487cca54efeeae5b5ba89db

    • Size

      1.2MB

    • MD5

      2a168b20a56413c440d9e8505fb26e50

    • SHA1

      a3b8532d93c97b22297ca877ced8465457d7af81

    • SHA256

      9a4245ee0429f775eea3dc26b694080cfa0d6a43f487cca54efeeae5b5ba89db

    • SHA512

      c5de5534fae193184696b0d52e9776a2c3fa9a970d532df0416e7504dce4f00e784882b8c5eecdca49c99672e9012551704af0fb6fdc1c2c9faca3bce7eeeae2

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks