Overview

overview

10

Static

static

7267885574...7a.dll

windows7_x64

10

7267885574...7a.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7267885574387dc8769908893f2c1ba297a0e4da0798105e1301247df2d8b97a

  • Size

    1.2MB

  • Sample

    220419-ewlbwsfbe4

  • MD5

    513fc64fd591db4f601b9ce9f2da15e0

  • SHA1

    c26e626dcf7c5328675ea73a672ff1b5d27d44a8

  • SHA256

    7267885574387dc8769908893f2c1ba297a0e4da0798105e1301247df2d8b97a

  • SHA512

    a120c47877119d939776c1532592a5b788b8af2185ad15a00fb466c07b916a7f46ac815cd1f2cf19f1974690d29bb812b4c664aa1a47199bc4f10788b2a6e8b1

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      7267885574387dc8769908893f2c1ba297a0e4da0798105e1301247df2d8b97a

    • Size

      1.2MB

    • MD5

      513fc64fd591db4f601b9ce9f2da15e0

    • SHA1

      c26e626dcf7c5328675ea73a672ff1b5d27d44a8

    • SHA256

      7267885574387dc8769908893f2c1ba297a0e4da0798105e1301247df2d8b97a

    • SHA512

      a120c47877119d939776c1532592a5b788b8af2185ad15a00fb466c07b916a7f46ac815cd1f2cf19f1974690d29bb812b4c664aa1a47199bc4f10788b2a6e8b1

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks