Overview

overview

10

Static

static

3

dridex

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    862a0d746be739a65c2571efc876c054112dc77f45598d22dd1d63e1e8db3419

  • Size

    480KB

  • Sample

    230505-z1nb9sha3w

  • MD5

    850f6491d2fc805a44349bb701040a6c

  • SHA1

    a8294e6d4ed0dec124abd4b74e05fa82e3cff53f

  • SHA256

    862a0d746be739a65c2571efc876c054112dc77f45598d22dd1d63e1e8db3419

  • SHA512

    a713bbadf2d55926986633c8932215263f5e0e2d60ce1300aa277c0f5138a4823dfc0d9f9bec0d85f74eb2e07a949197ad6991cd8ab6e279f9045e974ddeb932

  • SSDEEP

    12288:lMray90y+eI6qbYzzXXl3dKxE8b3Qr1ec33:LyX+tczzhdKrQcc33

Score
10/10
discoveryevasionpersistencespywarestealertrojan

Malware Config

Targets

    • Target

      862a0d746be739a65c2571efc876c054112dc77f45598d22dd1d63e1e8db3419

    • Size

      480KB

    • MD5

      850f6491d2fc805a44349bb701040a6c

    • SHA1

      a8294e6d4ed0dec124abd4b74e05fa82e3cff53f

    • SHA256

      862a0d746be739a65c2571efc876c054112dc77f45598d22dd1d63e1e8db3419

    • SHA512

      a713bbadf2d55926986633c8932215263f5e0e2d60ce1300aa277c0f5138a4823dfc0d9f9bec0d85f74eb2e07a949197ad6991cd8ab6e279f9045e974ddeb932

    • SSDEEP

      12288:lMray90y+eI6qbYzzXXl3dKxE8b3Qr1ec33:LyX+tczzhdKrQcc33

    Score
    10/10
    discoveryevasionpersistencespywarestealertrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Windows security modification

      evasiontrojan

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks