Overview

overview

10

Static

static

899cac1d02...fb.dll

windows7_x64

10

899cac1d02...fb.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb

  • Size

    1.3MB

  • Sample

    211126-lfxtbabefl

  • MD5

    cd87697a9e2bdfac82d9b7154c3105ce

  • SHA1

    963e78487647a3b7199211154b8fe7f6babe6bbb

  • SHA256

    899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb

  • SHA512

    ab1617bd35d7f07eb819ae467284985ea241d9e0c019970e5a5f0cd42a8b3eadb0ac3ea16d35a056620784c65f9b9b20410b39aa23c3119b6ddad2cfbe5400db

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb

    • Size

      1.3MB

    • MD5

      cd87697a9e2bdfac82d9b7154c3105ce

    • SHA1

      963e78487647a3b7199211154b8fe7f6babe6bbb

    • SHA256

      899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb

    • SHA512

      ab1617bd35d7f07eb819ae467284985ea241d9e0c019970e5a5f0cd42a8b3eadb0ac3ea16d35a056620784c65f9b9b20410b39aa23c3119b6ddad2cfbe5400db

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks