Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

  • Size

    58KB

  • Sample

    211021-1ahvjaagb7

  • MD5

    9d4458f6de6fb97b9b2a6ee9a69b62f4

  • SHA1

    b7e91d625d95e6b6c8452c0beb4d9900da1931a2

  • SHA256

    dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

  • SHA512

    a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

Score
10/10
evasionpersistenceransomwaretrojan

Malware Config

Extracted

Path

\??\M:\Read_Me.txt

Ransom Note
Attention! All your files, documents, photos, databases and other important files are encrypted The only method of recovering files is to purchase an unique decryptor. Only we can give you this decryptor and only we can recover your files. The server with your decryptor is in a closed network TOR. You can get there by the following ways: ---------------------------------------------------------------------------------------- 1. Download Tor browser - https://www.torproject.org/ 2. Install Tor browser 3. Open Tor Browser 4. Open link in TOR browser: http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NEGXZGST 5. and open ticket ---------------------------------------------------------------------------------------- Alternate communication channel here: https://yip.su/2QstD5
URLs

http://mmeeiix2ejdwkmseycljetmpiwebdvgjts75c63camjofn2cjdoulzqd.onion/?101NEGXZGST

https://yip.su/2QstD5

Targets

    • Target

      dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

    • Size

      58KB

    • MD5

      9d4458f6de6fb97b9b2a6ee9a69b62f4

    • SHA1

      b7e91d625d95e6b6c8452c0beb4d9900da1931a2

    • SHA256

      dfdf48403506835206467e72952fc59fa3fb3c9dabc36090e82979e0b3a624c7

    • SHA512

      a7b91a7df43fa0902192d34b556d6957954c2878f3329a347226bb2edcfa5a5c44de3e0e245bfd1bcf2efd3c4bcbbb6e7dc17528d5917798cb9795a53dd53e06

    Score
    10/10
    evasionpersistenceransomwaretrojan

    • Turns off Windows Defender SpyNet reporting

      evasion

    • Windows security bypass

      evasiontrojan

    • Nirsoft

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Windows security modification

      evasiontrojan

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

3
T1089

Modify Registry

4
T1112

Credential Access

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks