Overview

overview

8

Static

static

1

dridex

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    337cb8145047aa91240a1412ba640d7f4036cdebcf55fbe5f0a8b7c03243175e

  • Size

    4.9MB

  • Sample

    230328-rq1wlsbe56

  • MD5

    c9ec3fc9d8842a437e9ec34165dad5ba

  • SHA1

    7ee84e820875af1763b12a6b7ea54d266cba1e2a

  • SHA256

    337cb8145047aa91240a1412ba640d7f4036cdebcf55fbe5f0a8b7c03243175e

  • SHA512

    245ff95e81093a2be1c40e6b0bfd765057961fa5ae67f8d28b23c002e8f7e0e382b8d5df477974e9f397e17dd3c087b6bc6e5277cc42b6060aba42dfeef37614

  • SSDEEP

    98304:BmTkreMckP4dSznBIsMAg9MojFVk5gh72eY7wErdWyvD/zB3igYsxi:AYreMckPzBIsMAg+uFC52CMEBWyvDA

Score
8/10
collectiondiscoverypersistencespywarestealer

Malware Config

Targets

    • Target

      337cb8145047aa91240a1412ba640d7f4036cdebcf55fbe5f0a8b7c03243175e

    • Size

      4.9MB

    • MD5

      c9ec3fc9d8842a437e9ec34165dad5ba

    • SHA1

      7ee84e820875af1763b12a6b7ea54d266cba1e2a

    • SHA256

      337cb8145047aa91240a1412ba640d7f4036cdebcf55fbe5f0a8b7c03243175e

    • SHA512

      245ff95e81093a2be1c40e6b0bfd765057961fa5ae67f8d28b23c002e8f7e0e382b8d5df477974e9f397e17dd3c087b6bc6e5277cc42b6060aba42dfeef37614

    • SSDEEP

      98304:BmTkreMckP4dSznBIsMAg9MojFVk5gh72eY7wErdWyvD/zB3igYsxi:AYreMckPzBIsMAg+uFC52CMEBWyvDA

    Score
    8/10
    collectiondiscoverypersistencespywarestealer

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Sets service image path in registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook accounts

      collection

    • Accesses Microsoft Outlook profiles

      collection

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

2
T1114

Exfiltration

Command and Control

Impact

Tasks