Overview

overview

10

Static

static

751aa86b8a...ce.dll

windows7_x64

10

751aa86b8a...ce.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce

  • Size

    969KB

  • Sample

    220417-t28rpsdgc2

  • MD5

    62b5ce1d64dcb1b9f0c825ba62996856

  • SHA1

    5e7eea97f2c31a0ef3b2feb5c9de45a3869f63c0

  • SHA256

    751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce

  • SHA512

    fe1698172d163b1c1efe802ec0d573a492aa2c1cbb15b60d2c9b69ca0158205812d875180866e4cff8570dff45663eb85457fb0e48bbec99bbc8c570af87c7e3

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce

    • Size

      969KB

    • MD5

      62b5ce1d64dcb1b9f0c825ba62996856

    • SHA1

      5e7eea97f2c31a0ef3b2feb5c9de45a3869f63c0

    • SHA256

      751aa86b8a60dc64d572b01838e96f9b360f53cb6ec1ccbe50f8fb8a2980c0ce

    • SHA512

      fe1698172d163b1c1efe802ec0d573a492aa2c1cbb15b60d2c9b69ca0158205812d875180866e4cff8570dff45663eb85457fb0e48bbec99bbc8c570af87c7e3

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks