Overview

overview

10

Static

static

370f1c893a...1a.dll

windows7_x64

10

370f1c893a...1a.dll

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    370f1c893acaf12c7238a3977f0eda3cfaa660ccea43b1b61461d551501e371a

  • Size

    1MB

  • Sample

    220419-ex6n8afcf2

  • MD5

    a4e06cc670b5bd72bacd34ba263e9819

  • SHA1

    b028d9787d1c0f6cd10afa64f491caed94e172c9

  • SHA256

    370f1c893acaf12c7238a3977f0eda3cfaa660ccea43b1b61461d551501e371a

  • SHA512

    6f8774b2969cc4b4b7a6288f300c88467c776eadf00ee1cb25ac5d47d7db9ae34439d701e4d2fb153aaf4162243cace9fa7ddb9da76231ba0122fa6695c71603

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      370f1c893acaf12c7238a3977f0eda3cfaa660ccea43b1b61461d551501e371a

    • Size

      1MB

    • MD5

      a4e06cc670b5bd72bacd34ba263e9819

    • SHA1

      b028d9787d1c0f6cd10afa64f491caed94e172c9

    • SHA256

      370f1c893acaf12c7238a3977f0eda3cfaa660ccea43b1b61461d551501e371a

    • SHA512

      6f8774b2969cc4b4b7a6288f300c88467c776eadf00ee1cb25ac5d47d7db9ae34439d701e4d2fb153aaf4162243cace9fa7ddb9da76231ba0122fa6695c71603

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Modifies Installed Components in the registry

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

3
T1012

Peripheral Device Discovery

2
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks