Overview

overview

10

Static

static

3

dridex

windows10-1703-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    f6ad3fbb7204a48855e880b34782d67c60d6c0a59e9a07e956df21280b15da03

  • Size

    1.4MB

  • Sample

    230802-ejy28acf82

  • MD5

    e2130d535415f135e6bb1c83c743f5dd

  • SHA1

    a46ce35523aef744e9eaaa3bed0d23419df49318

  • SHA256

    f6ad3fbb7204a48855e880b34782d67c60d6c0a59e9a07e956df21280b15da03

  • SHA512

    03d6eefb06cdf7cd8da0c5678b7dc84fe2680fd8b4aa570267a7b20a7790ce18af53c7a29eeec6fe9af15941c8e15949b181aabec77fb695f1c2e113f1f43dfc

  • SSDEEP

    24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

Score
10/10
evasionpersistenceupx

Malware Config

Targets

    • Target

      f6ad3fbb7204a48855e880b34782d67c60d6c0a59e9a07e956df21280b15da03

    • Size

      1.4MB

    • MD5

      e2130d535415f135e6bb1c83c743f5dd

    • SHA1

      a46ce35523aef744e9eaaa3bed0d23419df49318

    • SHA256

      f6ad3fbb7204a48855e880b34782d67c60d6c0a59e9a07e956df21280b15da03

    • SHA512

      03d6eefb06cdf7cd8da0c5678b7dc84fe2680fd8b4aa570267a7b20a7790ce18af53c7a29eeec6fe9af15941c8e15949b181aabec77fb695f1c2e113f1f43dfc

    • SSDEEP

      24576:U2G/nvxW3Ww0tRp8GiXTBhq7yRDvHcUcjUvy0lr3Tl6icOB/UWoT:UbA30H4zF0UMSAicOB/UWk

    Score
    10/10
    evasionpersistenceupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies Windows Firewall

      evasion

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks