Overview

overview

8

Static

static

1

dridex

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c8aeaadf9052b9a10a5e46ab181002e693942ccaeaea07c6fb9151506a4b1b5d

  • Size

    4.8MB

  • Sample

    230327-y4nxjahb4w

  • MD5

    1f52b638a5b0a3d7b87eac385fbbb835

  • SHA1

    c7ceef0f5a541d8edcf20e1b7689d720bb82e7ca

  • SHA256

    c8aeaadf9052b9a10a5e46ab181002e693942ccaeaea07c6fb9151506a4b1b5d

  • SHA512

    610eec49245363fc2e949135b1b9aa575ff57f8621355b6a5053c79f9c11e4ff3097514a561b1022e7a576cc54d08a6eda7db18676fb19125597e21d53bfee83

  • SSDEEP

    98304:gUXOVPohzS21WsuG3JHGQyL6xQUgxA96L2lA3VD5CNBiNk5ajLfNO:gUXXzBjJxQDq9Y2lyVDANux

Score
8/10
collectiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      c8aeaadf9052b9a10a5e46ab181002e693942ccaeaea07c6fb9151506a4b1b5d

    • Size

      4.8MB

    • MD5

      1f52b638a5b0a3d7b87eac385fbbb835

    • SHA1

      c7ceef0f5a541d8edcf20e1b7689d720bb82e7ca

    • SHA256

      c8aeaadf9052b9a10a5e46ab181002e693942ccaeaea07c6fb9151506a4b1b5d

    • SHA512

      610eec49245363fc2e949135b1b9aa575ff57f8621355b6a5053c79f9c11e4ff3097514a561b1022e7a576cc54d08a6eda7db18676fb19125597e21d53bfee83

    • SSDEEP

      98304:gUXOVPohzS21WsuG3JHGQyL6xQUgxA96L2lA3VD5CNBiNk5ajLfNO:gUXXzBjJxQDq9Y2lyVDANux

    Score
    8/10
    collectiondiscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks