Overview

overview

10

Static

static

10

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cede6ac238893e42da9d3df998429d991ff02cdcd018f7de4e7b379c3d5fdc6a

  • Size

    84KB

  • Sample

    230320-bl765adb5z

  • MD5

    bc6da13176887a094ff712a2e2a58ba4

  • SHA1

    e67aff93f62eaf757b3167d86936cb71d653c8cf

  • SHA256

    cede6ac238893e42da9d3df998429d991ff02cdcd018f7de4e7b379c3d5fdc6a

  • SHA512

    555a7898693be4d4c5b265a6ed14656515efafd1f03beeb248e6aafafe3638095d39d5eb60589f74b5ca46a2fd835f182ca54ed0e1ad600c53098b57f57ed016

  • SSDEEP

    1536:qZye8psDhdvoYIflDvf+RBe50UE8Feu6JsuDTpU0WyTwJg:6vdvYlDvWRBeiUDTBwVU0H8O

Score
10/10
blackmoonbankerspywarestealertrojanupxvmprotect

Malware Config

Targets

    • Target

      cede6ac238893e42da9d3df998429d991ff02cdcd018f7de4e7b379c3d5fdc6a

    • Size

      84KB

    • MD5

      bc6da13176887a094ff712a2e2a58ba4

    • SHA1

      e67aff93f62eaf757b3167d86936cb71d653c8cf

    • SHA256

      cede6ac238893e42da9d3df998429d991ff02cdcd018f7de4e7b379c3d5fdc6a

    • SHA512

      555a7898693be4d4c5b265a6ed14656515efafd1f03beeb248e6aafafe3638095d39d5eb60589f74b5ca46a2fd835f182ca54ed0e1ad600c53098b57f57ed016

    • SSDEEP

      1536:qZye8psDhdvoYIflDvf+RBe50UE8Feu6JsuDTpU0WyTwJg:6vdvYlDvWRBeiUDTBwVU0H8O

    Score
    10/10
    blackmoonbankerspywarestealertrojanupxvmprotect

    • Blackmoon, KrBanker

      Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.

      trojanbankerblackmoon

    • Detect Blackmoon payload

    • Downloads MZ/PE file

    • Drops file in Drivers directory

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks