Overview

overview

8

Static

static

7

dridex

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    88e21ed3c426de5ef66a72fd451e4a97f8c7d60169942e47b7d85d6f33bd4873

  • Size

    8.8MB

  • Sample

    230125-m5vwpafg79

  • MD5

    10b4f109f82f2dab060cdfe8b9167c61

  • SHA1

    13373d528cd777ba22a6c4b7bab5231f63e4ae5b

  • SHA256

    88e21ed3c426de5ef66a72fd451e4a97f8c7d60169942e47b7d85d6f33bd4873

  • SHA512

    ea72beafccc6962ec10dca3de3c96c4f1dea587c57fc498e09af1c6d3e565a886d1fa8920f48fa256bb9ce73f72a66059d3f8431af200ffa6292e3eb8c7ab6d4

  • SSDEEP

    196608:fnTm6cPlq0PhetcgP2RT+7GU7FrN9Hrmdq5m7Th2KeROQ:q3q0PZTiGUhrNpydqEvh28Q

Score
8/10
persistencethemida

Malware Config

Targets

    • Target

      88e21ed3c426de5ef66a72fd451e4a97f8c7d60169942e47b7d85d6f33bd4873

    • Size

      8.8MB

    • MD5

      10b4f109f82f2dab060cdfe8b9167c61

    • SHA1

      13373d528cd777ba22a6c4b7bab5231f63e4ae5b

    • SHA256

      88e21ed3c426de5ef66a72fd451e4a97f8c7d60169942e47b7d85d6f33bd4873

    • SHA512

      ea72beafccc6962ec10dca3de3c96c4f1dea587c57fc498e09af1c6d3e565a886d1fa8920f48fa256bb9ce73f72a66059d3f8431af200ffa6292e3eb8c7ab6d4

    • SSDEEP

      196608:fnTm6cPlq0PhetcgP2RT+7GU7FrN9Hrmdq5m7Th2KeROQ:q3q0PZTiGUhrNpydqEvh28Q

    Score
    8/10
    persistencethemida

    • Executes dropped EXE

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Adds Run key to start application

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks