Overview

overview

10

Static

static

1

dridex

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

  • Size

    1.3MB

  • Sample

    230330-gxelvabb74

  • MD5

    f700265edb6c2500e9524567708311ff

  • SHA1

    a41d5791eb1337a1eb7cb5e7f4d19e58527491bd

  • SHA256

    9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

  • SHA512

    367059d7399d088d7a21056e95401047f090cf6c3aee99392e8d4f466a78c8ff1db4ba3a9e9c2e73ed4429e60c9f47450cf802919ecd1178410ba9990e2f2da5

  • SSDEEP

    24576:RlrzYhkMmg95wf0/7Xqu/l2AcyezF2jammpFOFbGe8utDcG5oDHWOJv1e:jckO95wfW24Rexy3mpgFbGfutUzvg

Score
10/10
adwareevasionpersistencetrojan

Malware Config

Targets

    • Target

      9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

    • Size

      1.3MB

    • MD5

      f700265edb6c2500e9524567708311ff

    • SHA1

      a41d5791eb1337a1eb7cb5e7f4d19e58527491bd

    • SHA256

      9dffd674f59f033d47fa79136a2d4dafe4973345f8f669d5a98fc23f5bf267f7

    • SHA512

      367059d7399d088d7a21056e95401047f090cf6c3aee99392e8d4f466a78c8ff1db4ba3a9e9c2e73ed4429e60c9f47450cf802919ecd1178410ba9990e2f2da5

    • SSDEEP

      24576:RlrzYhkMmg95wf0/7Xqu/l2AcyezF2jammpFOFbGe8utDcG5oDHWOJv1e:jckO95wfW24Rexy3mpgFbGfutUzvg

    Score
    10/10
    adwareevasionpersistencetrojan

    • UAC bypass

      evasiontrojan

    • Allows Chrome notifications for new domains

      adware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

6
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks