Overview

overview

10

Static

static

c80a6055c1...3d.dll

windows7_x64

10

c80a6055c1...3d.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d

  • Size

    1.3MB

  • Sample

    211126-lgl37segf9

  • MD5

    3264df29f9af6fdccad5f6c62793f158

  • SHA1

    2901853e6dabaee7a82549952a17997caaacb046

  • SHA256

    c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d

  • SHA512

    9bd36e375bea27aa5ce154119031343c8157c88f81a871b45b128b28ce6a7494f6e3eb38d83bf0ae207b62ea01ffa8ce13289c76aa0abb2e9a982c098ecc8cab

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d

    • Size

      1.3MB

    • MD5

      3264df29f9af6fdccad5f6c62793f158

    • SHA1

      2901853e6dabaee7a82549952a17997caaacb046

    • SHA256

      c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d

    • SHA512

      9bd36e375bea27aa5ce154119031343c8157c88f81a871b45b128b28ce6a7494f6e3eb38d83bf0ae207b62ea01ffa8ce13289c76aa0abb2e9a982c098ecc8cab

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks