Overview

overview

8

Static

static

1

dridex

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    3fbaf3c1f42f5946fcbbddc6e77a0e576cc17e7314b7c3ad9bdd0a9fa97518dc

  • Size

    4.9MB

  • Sample

    230328-1f1yasfb8s

  • MD5

    2e02f4c57662267b97043d2f3be770ad

  • SHA1

    9d5ba8fa90795fa6df32eb668cc0da7782b8dfd8

  • SHA256

    3fbaf3c1f42f5946fcbbddc6e77a0e576cc17e7314b7c3ad9bdd0a9fa97518dc

  • SHA512

    4b58e1613b21a518d054aee5b5e843c6f50530d1e1907134a458fe84efd5c50c795d1c3b5418944cf9e32ddf9fad524fd4249ab18ddf431caa0a78c784d5ca6f

  • SSDEEP

    98304:wV8Riqc9m1PTA0KNOKrFwjJTSFLLMI8DadmTyr73K4DxWRIg1R0w:wV8bc9m1grFwjAFpfUY73JDxU1t

Score
8/10
collectiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      3fbaf3c1f42f5946fcbbddc6e77a0e576cc17e7314b7c3ad9bdd0a9fa97518dc

    • Size

      4.9MB

    • MD5

      2e02f4c57662267b97043d2f3be770ad

    • SHA1

      9d5ba8fa90795fa6df32eb668cc0da7782b8dfd8

    • SHA256

      3fbaf3c1f42f5946fcbbddc6e77a0e576cc17e7314b7c3ad9bdd0a9fa97518dc

    • SHA512

      4b58e1613b21a518d054aee5b5e843c6f50530d1e1907134a458fe84efd5c50c795d1c3b5418944cf9e32ddf9fad524fd4249ab18ddf431caa0a78c784d5ca6f

    • SSDEEP

      98304:wV8Riqc9m1PTA0KNOKrFwjJTSFLLMI8DadmTyr73K4DxWRIg1R0w:wV8bc9m1grFwjAFpfUY73JDxU1t

    Score
    8/10
    collectiondiscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks