Overview

overview

10

Static

static

6107415003...1f.dll

windows7_x64

8

6107415003...1f.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6107415003f717927e8d2e7ecdf89ff740d436190ee0ce5bcfc196c7c82df31f

  • Size

    1MB

  • Sample

    220419-ewse7sfbf5

  • MD5

    16c8d8cea25cbd0df5764829353b6ad9

  • SHA1

    1dae3e18528b7aea8c93d5208b0723734d0b7c54

  • SHA256

    6107415003f717927e8d2e7ecdf89ff740d436190ee0ce5bcfc196c7c82df31f

  • SHA512

    646c7d2c2332e4e0ed2df8d4bfba6dc6921e70e54c144c7fa70f7d0e17dff6d0d81eb4b4ea1a32859380ac7195d57240df5adbf1fe1c3ce288a31c735a4d08c5

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      6107415003f717927e8d2e7ecdf89ff740d436190ee0ce5bcfc196c7c82df31f

    • Size

      1MB

    • MD5

      16c8d8cea25cbd0df5764829353b6ad9

    • SHA1

      1dae3e18528b7aea8c93d5208b0723734d0b7c54

    • SHA256

      6107415003f717927e8d2e7ecdf89ff740d436190ee0ce5bcfc196c7c82df31f

    • SHA512

      646c7d2c2332e4e0ed2df8d4bfba6dc6921e70e54c144c7fa70f7d0e17dff6d0d81eb4b4ea1a32859380ac7195d57240df5adbf1fe1c3ce288a31c735a4d08c5

    Score
    10/10
    evasionpersistencetrojandridexbotnetpayload

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks