dridex | e98ec64dd1a7e8a99356a9ee5c619df9d93bc0be63df2ea03e30c01d37b4da2b | Triage

Sharing

General

Target

fc0aa6dcbc1cfdd09dd1e8bacb20ef16
Size

1.7MB
Sample

231222-vqak7sbeel
MD5

fc0aa6dcbc1cfdd09dd1e8bacb20ef16
SHA1

8840124afefe1d0401b17f9cf49403699eec6872
SHA256

e98ec64dd1a7e8a99356a9ee5c619df9d93bc0be63df2ea03e30c01d37b4da2b
SHA512

42a0d90d28ca5d75c915a777502543fc3ef77f2edfe60cf155b91b840693007a88a60c2a3722f2663832292027ae1149d9098b0b34f3c81d914ecea35a0af911
SSDEEP

12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  fc0aa6dcbc1cfdd09dd1e8bacb20ef16
- Size
  
  1.7MB
- MD5
  
  fc0aa6dcbc1cfdd09dd1e8bacb20ef16
- SHA1
  
  8840124afefe1d0401b17f9cf49403699eec6872
- SHA256
  
  e98ec64dd1a7e8a99356a9ee5c619df9d93bc0be63df2ea03e30c01d37b4da2b
- SHA512
  
  42a0d90d28ca5d75c915a777502543fc3ef77f2edfe60cf155b91b840693007a88a60c2a3722f2663832292027ae1149d9098b0b34f3c81d914ecea35a0af911
- SSDEEP
  
  12288:rVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:qfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan