Overview

overview

10

Static

static

10

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bad9b63870daa9d4976129b7ac5fabc721d7950017e2151035b4c7747a6ed09a

  • Size

    1.7MB

  • Sample

    220819-xcwmmahbbn

  • MD5

    226328c111a2cccf9a4a2d576ab9a5e9

  • SHA1

    7fd7b703a12b44932872d7f5bc420b3cfa0c8b1d

  • SHA256

    bad9b63870daa9d4976129b7ac5fabc721d7950017e2151035b4c7747a6ed09a

  • SHA512

    39a03007b7f06f74ad1b00626028acaa53aa2740f2a20b87ef37aaff5e95588a2bb26762756747a83a628b6790ff1ff155bfb53b32e802e90bfcf404c4766155

  • SSDEEP

    24576:DJpBm3bRcquX2rVqygIOsdV1ytApVLXPtmnwlcYOaf5eznYYF9MCFFRXPLeb:DJyLRqsnV1ytAjzPYzG5ejYI+MXq

Score
10/10
dcratdiscoveryevasionexploitinfostealerpersistenceratspywarestealertrojan

Malware Config

Targets

    • Target

      bad9b63870daa9d4976129b7ac5fabc721d7950017e2151035b4c7747a6ed09a

    • Size

      1.7MB

    • MD5

      226328c111a2cccf9a4a2d576ab9a5e9

    • SHA1

      7fd7b703a12b44932872d7f5bc420b3cfa0c8b1d

    • SHA256

      bad9b63870daa9d4976129b7ac5fabc721d7950017e2151035b4c7747a6ed09a

    • SHA512

      39a03007b7f06f74ad1b00626028acaa53aa2740f2a20b87ef37aaff5e95588a2bb26762756747a83a628b6790ff1ff155bfb53b32e802e90bfcf404c4766155

    • SSDEEP

      24576:DJpBm3bRcquX2rVqygIOsdV1ytApVLXPtmnwlcYOaf5eznYYF9MCFFRXPLeb:DJyLRqsnV1ytAjzPYzG5ejYI+MXq

    Score
    10/10
    dcratdiscoveryevasionexploitinfostealerpersistenceratspywarestealertrojan

    • DcRat

      DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.

      ratinfostealerdcrat

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • UAC bypass

      evasiontrojan

    • DCRat payload

      Detects payload of DCRat, commonly dropped by NSIS installers.

      rat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Possible privilege escalation attempt

      exploit

    • Stops running service(s)

      evasion

    • Modifies file permissions

      discovery

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks