Overview

overview

8

Static

static

1

dridex

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5dd0d509a4f5216e1c8c8a9701f545930ded885a32b20751fc3b9ca2699d7d58

  • Size

    3.7MB

  • Sample

    230206-tsmswaeg86

  • MD5

    9f416b6172c39eeb1447081f48bcb1b7

  • SHA1

    e9659f79ebc158eadcaedf159d95d68e86e7e13f

  • SHA256

    5dd0d509a4f5216e1c8c8a9701f545930ded885a32b20751fc3b9ca2699d7d58

  • SHA512

    770e35b3803fc0ae3522d2785fac70600e9299bc437e601c5c4e26f4bfa42639b60b9835ad22cc7e3b3775fb85b2fe9a14428c5877a9b93c6d90bd609b79bb67

  • SSDEEP

    98304:2ZF+UtCLWySWk2sswA2RSWwkEOuUbTsq4o+wlSJW:AF5tDtWk9sR2RSW8yT4UA

Score
8/10
collectiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      5dd0d509a4f5216e1c8c8a9701f545930ded885a32b20751fc3b9ca2699d7d58

    • Size

      3.7MB

    • MD5

      9f416b6172c39eeb1447081f48bcb1b7

    • SHA1

      e9659f79ebc158eadcaedf159d95d68e86e7e13f

    • SHA256

      5dd0d509a4f5216e1c8c8a9701f545930ded885a32b20751fc3b9ca2699d7d58

    • SHA512

      770e35b3803fc0ae3522d2785fac70600e9299bc437e601c5c4e26f4bfa42639b60b9835ad22cc7e3b3775fb85b2fe9a14428c5877a9b93c6d90bd609b79bb67

    • SSDEEP

      98304:2ZF+UtCLWySWk2sswA2RSWwkEOuUbTsq4o+wlSJW:AF5tDtWk9sR2RSW8yT4UA

    Score
    8/10
    collectiondiscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks