Overview

overview

10

Static

static

dridex

windows10_x64

10
General
Target

613df014511b022045728afac469eb460e95ee7773e1a9e6083cc6f5ca2fe6aa

Size

727KB

Sample

211016-a1mnasbfb3

Score
10/10
MD5

2cbbe36a44658b6641048bfd57e1ea7f

SHA1

197d39e7067afe3119a15729d39e6c05df672f05

SHA256

613df014511b022045728afac469eb460e95ee7773e1a9e6083cc6f5ca2fe6aa

SHA512

d61fd507d0d77339c165df0df11365558a408c08e50c1ceac594e93100bba40b4cf672b161cd2f731931b6f8636b4afee0c598f1b8f241f5a33dc8f68ab2b7d5

Malware Config

Extracted

Family

vidar
Version

41.4
Botnet

1008
C2

https://mas.to/@sslam
Attributes
profile_id
1008
Targets
Target

613df014511b022045728afac469eb460e95ee7773e1a9e6083cc6f5ca2fe6aa

MD5

2cbbe36a44658b6641048bfd57e1ea7f

Filesize

727KB

Score
10/10
SHA1

197d39e7067afe3119a15729d39e6c05df672f05

SHA256

613df014511b022045728afac469eb460e95ee7773e1a9e6083cc6f5ca2fe6aa

SHA512

d61fd507d0d77339c165df0df11365558a408c08e50c1ceac594e93100bba40b4cf672b161cd2f731931b6f8636b4afee0c598f1b8f241f5a33dc8f68ab2b7d5

Tags

Signatures

  • ServHelper

    Description

    ServHelper is a backdoor written in Delphi and is associated with the hacking group TA505.

    Tags

  • Vidar

    Description

    Vidar is an infostealer based on Arkei stealer.

    Tags

  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • Grants admin privileges

    Description

    Uses net.exe to modify the user's privileges.

    TTPs

    Account Manipulation

  • Vidar Stealer

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Modifies RDP port number used by Windows

    TTPs

    Remote Desktop Protocol

  • Sets DLL path for service in the registry

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Description

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    Tags

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files

  • Accesses 2FA software files, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files

  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

Related Tasks

behavioral1
MITRE ATT&CK Matrix
Collection
Command and Control
    Credential Access
    Defense Evasion
    Discovery
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
            Persistence
            Privilege Escalation