Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    adcba5aefb10651aed6faf01a5e146a4e7a615b63f4b235f94c613d1503fca7c

  • Size

    4.1MB

  • Sample

    220918-p98dpafbgk

  • MD5

    0dcfd4d596a94407d377d5bd23e9259f

  • SHA1

    67bff1095dc04c6be9af57d366b34ffaf0f15fc0

  • SHA256

    adcba5aefb10651aed6faf01a5e146a4e7a615b63f4b235f94c613d1503fca7c

  • SHA512

    4044068b5ecf53322cdddb108645b2fbe10ab035eb0fa20cd74b0a53e6ba36275d96ded3e957b151993a1f4afd850cad73daac0e04e4caf1729c2bfa774e17a8

  • SSDEEP

    98304:HEYtZjXC99GEkBganfdT9zFY2HqaAN3ELgnbpJtZI:hY9EXFT7U08ndq

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      adcba5aefb10651aed6faf01a5e146a4e7a615b63f4b235f94c613d1503fca7c

    • Size

      4.1MB

    • MD5

      0dcfd4d596a94407d377d5bd23e9259f

    • SHA1

      67bff1095dc04c6be9af57d366b34ffaf0f15fc0

    • SHA256

      adcba5aefb10651aed6faf01a5e146a4e7a615b63f4b235f94c613d1503fca7c

    • SHA512

      4044068b5ecf53322cdddb108645b2fbe10ab035eb0fa20cd74b0a53e6ba36275d96ded3e957b151993a1f4afd850cad73daac0e04e4caf1729c2bfa774e17a8

    • SSDEEP

      98304:HEYtZjXC99GEkBganfdT9zFY2HqaAN3ELgnbpJtZI:hY9EXFT7U08ndq

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks