Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54

  • Size

    523KB

  • Sample

    220625-hc4wnshfdk

  • MD5

    398ed7c0939e72a1df48196488ec00c8

  • SHA1

    4f6f076492ead1416d1d64158117c8b50cac4e88

  • SHA256

    d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54

  • SHA512

    4fb615c0aceec14063aba4da8cc105723cb1a480564eb95b70b4ebdfeb25a04cd80c0f07e47017ee5b0f2169f344e919e1f2f2a3c6f978fa074f8cf0a8439818

Score
10/10
recordbreakerevasionpersistencestealertrojan

Malware Config

Extracted

Family

recordbreaker

C2

http://2.58.56.247

Targets

    • Target

      d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54

    • Size

      523KB

    • MD5

      398ed7c0939e72a1df48196488ec00c8

    • SHA1

      4f6f076492ead1416d1d64158117c8b50cac4e88

    • SHA256

      d407dea31b4e55d9955bdea84e990205f7bbea67fd39e82bb61f942dc20e9b54

    • SHA512

      4fb615c0aceec14063aba4da8cc105723cb1a480564eb95b70b4ebdfeb25a04cd80c0f07e47017ee5b0f2169f344e919e1f2f2a3c6f978fa074f8cf0a8439818

    Score
    10/10
    recordbreakerevasionpersistencestealertrojan

    • RecordBreaker

      RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.

      stealerrecordbreaker

    • UAC bypass

      evasiontrojan

    • Windows security bypass

      evasiontrojan

    • Grants admin privileges

      Uses net.exe to modify the user's privileges.

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Nirsoft

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Account Manipulation

1
T1098

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

5
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

4
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks