Overview

overview

10

Static

static

3

NEAS.1f0b3...JC.dll

windows7-x64

10

NEAS.1f0b3...JC.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    NEAS.1f0b38d9dc62745336ed59f23ef9d930_JC.exe

  • Size

    3.7MB

  • Sample

    231021-yarrbshd8x

  • MD5

    1f0b38d9dc62745336ed59f23ef9d930

  • SHA1

    ca7103f7e63dc73d6539dc31a6f1f897ffee4411

  • SHA256

    f7ecbb2280d3798f34c6d54d342aaa1ee2be6fb909570643712fb9285456517e

  • SHA512

    9d383d343322f11f70a4255f2062dffcc77ea2af2ea31575941dcbf7dd7886bd938c1111385028098e1184568919986714cd57722da442397cc64924636d93e0

  • SSDEEP

    24576:P8uea4w467D5/0ypyFYELW8xFZmMXJZA:FXyFYELpT

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      NEAS.1f0b38d9dc62745336ed59f23ef9d930_JC.exe

    • Size

      3.7MB

    • MD5

      1f0b38d9dc62745336ed59f23ef9d930

    • SHA1

      ca7103f7e63dc73d6539dc31a6f1f897ffee4411

    • SHA256

      f7ecbb2280d3798f34c6d54d342aaa1ee2be6fb909570643712fb9285456517e

    • SHA512

      9d383d343322f11f70a4255f2062dffcc77ea2af2ea31575941dcbf7dd7886bd938c1111385028098e1184568919986714cd57722da442397cc64924636d93e0

    • SSDEEP

      24576:P8uea4w467D5/0ypyFYELW8xFZmMXJZA:FXyFYELpT

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks