Overview

overview

10

Static

static

b8eeb8c59a...f0.dll

windows7_x64

10

b8eeb8c59a...f0.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b8eeb8c59a0b5352f8c313e727fddb899875960df029eaca7e868610702cfaf0

  • Size

    1.2MB

  • Sample

    220417-t2368aahdn

  • MD5

    754bb938d40d9602980e2e9ec5a4e927

  • SHA1

    45b9def51ab5c99967127db3ed203ebeced50cc3

  • SHA256

    b8eeb8c59a0b5352f8c313e727fddb899875960df029eaca7e868610702cfaf0

  • SHA512

    87cd8995040a8f487f7ae45d4d0f31b658504c6060acd7c3948c8bd1c27ceb67045882bf73dd541ab05421089a7addff0b0318fd85f78c117a6acdc2a86264c2

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      b8eeb8c59a0b5352f8c313e727fddb899875960df029eaca7e868610702cfaf0

    • Size

      1.2MB

    • MD5

      754bb938d40d9602980e2e9ec5a4e927

    • SHA1

      45b9def51ab5c99967127db3ed203ebeced50cc3

    • SHA256

      b8eeb8c59a0b5352f8c313e727fddb899875960df029eaca7e868610702cfaf0

    • SHA512

      87cd8995040a8f487f7ae45d4d0f31b658504c6060acd7c3948c8bd1c27ceb67045882bf73dd541ab05421089a7addff0b0318fd85f78c117a6acdc2a86264c2

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks