Overview

overview

9

Static

static

1

dridex

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3607ee68ec4b6286a7a570ffdbcb841a4da254f466baaf8626c8fd1152f2a849

  • Size

    3.4MB

  • Sample

    230319-b8qwcsge3x

  • MD5

    0d8a4728374701186f4aa0450cb90bce

  • SHA1

    c18db5ffd5d29bfdff209ab09aa19da0a8d39b73

  • SHA256

    3607ee68ec4b6286a7a570ffdbcb841a4da254f466baaf8626c8fd1152f2a849

  • SHA512

    618538e43434f3fc4e23d9e3fdf7ea67f76bd64150e94dc52ee5429845c4eb3b7062f8cf7b98578b7dc43295871acc61de3e7d2ee57cc7f813e71fe9af61649e

  • SSDEEP

    49152:Or1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVloL:FKvfd94XayMT5sH9M0aS8o9uWyUhHyO

Score
9/10
discoveryevasiontrojanupx

Malware Config

Targets

    • Target

      3607ee68ec4b6286a7a570ffdbcb841a4da254f466baaf8626c8fd1152f2a849

    • Size

      3.4MB

    • MD5

      0d8a4728374701186f4aa0450cb90bce

    • SHA1

      c18db5ffd5d29bfdff209ab09aa19da0a8d39b73

    • SHA256

      3607ee68ec4b6286a7a570ffdbcb841a4da254f466baaf8626c8fd1152f2a849

    • SHA512

      618538e43434f3fc4e23d9e3fdf7ea67f76bd64150e94dc52ee5429845c4eb3b7062f8cf7b98578b7dc43295871acc61de3e7d2ee57cc7f813e71fe9af61649e

    • SSDEEP

      49152:Or1c7Kvf8e9HTgXHXayMSTQ5c1ztH9rDDQvOJRg05T0Oa/rm2ho8IucxzrurVloL:FKvfd94XayMT5sH9M0aS8o9uWyUhHyO

    Score
    9/10
    discoveryevasiontrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks