Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4247fce09bfac158cebdc9446dcd8ceb978fdd145c1b56923c6498895bd23449

  • Size

    4.2MB

  • Sample

    220927-k8xtcaebej

  • MD5

    499038eaa37975bfc1d3d0d8ea9c494f

  • SHA1

    8bed7c38893b998c2354dafab118ace1413f5223

  • SHA256

    4247fce09bfac158cebdc9446dcd8ceb978fdd145c1b56923c6498895bd23449

  • SHA512

    777531510a82e6ff738ad9d20be574c0475c59d9ebb7448f5a3c8ec967a7c39f1441a04c1af53bf0a5f1e20fef860d2af4cb991c02be3a1339e30e776bceb387

  • SSDEEP

    98304:zHHOgMKbVwHMl5ExQPlNDIoRPU1THgwIsIijIaA3z30aGrd:bpIK5ExQtSJpHgE9jIaAgaG

Score
10/10
gluptebadiscoverydropperevasionloaderpersistence

Malware Config

Targets

    • Target

      4247fce09bfac158cebdc9446dcd8ceb978fdd145c1b56923c6498895bd23449

    • Size

      4.2MB

    • MD5

      499038eaa37975bfc1d3d0d8ea9c494f

    • SHA1

      8bed7c38893b998c2354dafab118ace1413f5223

    • SHA256

      4247fce09bfac158cebdc9446dcd8ceb978fdd145c1b56923c6498895bd23449

    • SHA512

      777531510a82e6ff738ad9d20be574c0475c59d9ebb7448f5a3c8ec967a7c39f1441a04c1af53bf0a5f1e20fef860d2af4cb991c02be3a1339e30e776bceb387

    • SSDEEP

      98304:zHHOgMKbVwHMl5ExQPlNDIoRPU1THgwIsIijIaA3z30aGrd:bpIK5ExQtSJpHgE9jIaAgaG

    Score
    10/10
    gluptebadiscoverydropperevasionloaderpersistence

    • Glupteba

      Glupteba is a modular loader written in Golang with various components.

      loaderdropperglupteba

    • Suspicious use of NtCreateUserProcessOtherParentProcess

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks