dridex | e4f91dea14a7d9768e2b437194a6095287d763b9232b7cba6cd2c4fcac1733b8 | Triage

Sharing

General

Target

402e76f8c262213bd23fa06a85d3756d_JaffaCakes118
Size

991KB
Sample

240513-s1jwhscc9y
MD5

402e76f8c262213bd23fa06a85d3756d
SHA1

6c844d7dae73a9d8a1be421abce0672c0a2a173c
SHA256

e4f91dea14a7d9768e2b437194a6095287d763b9232b7cba6cd2c4fcac1733b8
SHA512

0ecfb0e06005c85f15ff9096eda2d398e5aadeed799219e288df42ab58a4d9f431be29fe6b90f8f1e1fcb8878b1cd6a4ba511a172fc65ce842fcb8190092ad60
SSDEEP

24576:fVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:fV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  402e76f8c262213bd23fa06a85d3756d_JaffaCakes118
- Size
  
  991KB
- MD5
  
  402e76f8c262213bd23fa06a85d3756d
- SHA1
  
  6c844d7dae73a9d8a1be421abce0672c0a2a173c
- SHA256
  
  e4f91dea14a7d9768e2b437194a6095287d763b9232b7cba6cd2c4fcac1733b8
- SHA512
  
  0ecfb0e06005c85f15ff9096eda2d398e5aadeed799219e288df42ab58a4d9f431be29fe6b90f8f1e1fcb8878b1cd6a4ba511a172fc65ce842fcb8190092ad60
- SSDEEP
  
  24576:fVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:fV8hf6STw1ZlQauvzSq01ICe6zvm
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan