Overview

overview

8

Static

static

dridex

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8bffaa7522696c6760727929ec1c15b5aa346333f2c38833d23fbd5ed5765f13

  • Size

    1.0MB

  • Sample

    221123-h82fesfb27

  • MD5

    113c46ff43811083942746787c74670e

  • SHA1

    4ccf9e38b219780b732f829a67bf4737a58a80bf

  • SHA256

    8bffaa7522696c6760727929ec1c15b5aa346333f2c38833d23fbd5ed5765f13

  • SHA512

    d9cca0c584c19a0ef8f247a865f8bb9ccb0d92f577ca32597c21fd15c884d14fc8d9c81fc0f0ad43f182a48b72912ef4d04e9c633eb9d3cbf84bb8e36d885488

  • SSDEEP

    24576:Kp/LIlPvXbXPHyJr1zGmWw3fCnJwgPF2BBYR:Kx8lPDshGXwPUJwgonY

Score
8/10
collectiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      8bffaa7522696c6760727929ec1c15b5aa346333f2c38833d23fbd5ed5765f13

    • Size

      1.0MB

    • MD5

      113c46ff43811083942746787c74670e

    • SHA1

      4ccf9e38b219780b732f829a67bf4737a58a80bf

    • SHA256

      8bffaa7522696c6760727929ec1c15b5aa346333f2c38833d23fbd5ed5765f13

    • SHA512

      d9cca0c584c19a0ef8f247a865f8bb9ccb0d92f577ca32597c21fd15c884d14fc8d9c81fc0f0ad43f182a48b72912ef4d04e9c633eb9d3cbf84bb8e36d885488

    • SSDEEP

      24576:Kp/LIlPvXbXPHyJr1zGmWw3fCnJwgPF2BBYR:Kx8lPDshGXwPUJwgonY

    Score
    8/10
    collectiondiscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks