Overview

overview

10

Static

static

49fdafcb6c...96.dll

windows7_x64

10

49fdafcb6c...96.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49fdafcb6cd2de9ad2f9fe206849dca0f0a0ec5d789f5d233592c2d0ac9ac196

  • Size

    882KB

  • Sample

    220417-seedxaggel

  • MD5

    26bcda26b072631f82eeaf26e9f1e2f3

  • SHA1

    406dfdea2817a9b2575f36faa6903a66dce8d6db

  • SHA256

    49fdafcb6cd2de9ad2f9fe206849dca0f0a0ec5d789f5d233592c2d0ac9ac196

  • SHA512

    389dac3dbab8255dab1d5e86dfc14477f92dead694c129bcb0d47c1bcacc0a7f40b2a347b90692854d53ecb71091d6166f84e7e45d72a9b5139f8eb7b6bcc8a7

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      49fdafcb6cd2de9ad2f9fe206849dca0f0a0ec5d789f5d233592c2d0ac9ac196

    • Size

      882KB

    • MD5

      26bcda26b072631f82eeaf26e9f1e2f3

    • SHA1

      406dfdea2817a9b2575f36faa6903a66dce8d6db

    • SHA256

      49fdafcb6cd2de9ad2f9fe206849dca0f0a0ec5d789f5d233592c2d0ac9ac196

    • SHA512

      389dac3dbab8255dab1d5e86dfc14477f92dead694c129bcb0d47c1bcacc0a7f40b2a347b90692854d53ecb71091d6166f84e7e45d72a9b5139f8eb7b6bcc8a7

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks