Overview

overview

10

Static

static

402d661701...65.dll

windows7_x64

10

402d661701...65.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65

  • Size

    1.2MB

  • Sample

    211126-lgl37sbegj

  • MD5

    156ccf8324c479a229603a59485b1b68

  • SHA1

    bd071acdbd27c66fa091ab07c1a079c57475f9a7

  • SHA256

    402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65

  • SHA512

    b5f138f7e609f461f155e9059cb2dd9852582fcd01145bf85f92e17809a86fe767d3d5b37ddb7789f38bcc9897da2f482152ccf0621ec967dbb613d54c9e86de

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65

    • Size

      1.2MB

    • MD5

      156ccf8324c479a229603a59485b1b68

    • SHA1

      bd071acdbd27c66fa091ab07c1a079c57475f9a7

    • SHA256

      402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65

    • SHA512

      b5f138f7e609f461f155e9059cb2dd9852582fcd01145bf85f92e17809a86fe767d3d5b37ddb7789f38bcc9897da2f482152ccf0621ec967dbb613d54c9e86de

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks