Overview

overview

9

Static

static

1

dridex

windows10-1703-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9790d98028a4316a159fbe080aee671230e235972881ed6e493980c6a0c0d7d

  • Size

    3.4MB

  • Sample

    230328-alcjsaga34

  • MD5

    6bc19beb032774ef35b27194493d7c2c

  • SHA1

    d9317e4a39771d5817b12b295f45bf60fd835422

  • SHA256

    f9790d98028a4316a159fbe080aee671230e235972881ed6e493980c6a0c0d7d

  • SHA512

    66634c2f4915cc3e05eb9677db540dcf69cab0888151f8360552dfb3728fd20a74a273eefcd29075b37e6d37c6f99cb3c839dc82e1a2443d954cdf1b6f800d40

  • SSDEEP

    98304:ZJuR21C/yIq/dhl/O4i/TksjdFwvhzjMSwRV6:Z8D/yIqlhlW4i/QsnwZzjMSeV6

Score
9/10
discoveryevasiontrojanupx

Malware Config

Targets

    • Target

      f9790d98028a4316a159fbe080aee671230e235972881ed6e493980c6a0c0d7d

    • Size

      3.4MB

    • MD5

      6bc19beb032774ef35b27194493d7c2c

    • SHA1

      d9317e4a39771d5817b12b295f45bf60fd835422

    • SHA256

      f9790d98028a4316a159fbe080aee671230e235972881ed6e493980c6a0c0d7d

    • SHA512

      66634c2f4915cc3e05eb9677db540dcf69cab0888151f8360552dfb3728fd20a74a273eefcd29075b37e6d37c6f99cb3c839dc82e1a2443d954cdf1b6f800d40

    • SSDEEP

      98304:ZJuR21C/yIq/dhl/O4i/TksjdFwvhzjMSwRV6:Z8D/yIqlhlW4i/QsnwZzjMSeV6

    Score
    9/10
    discoveryevasiontrojanupx

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Executes dropped EXE

    • Modifies file permissions

      discovery

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

File Permissions Modification

1
T1222

Credential Access

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks