dridex | 26d370fac05289d2d7895acb5ab970e500769b0fff27e5807a0edf36a662926f | Triage

Sharing

General

Target

2659ed2cb4afab7a842b055f23ffd340_JaffaCakes118
Size

1.2MB
Sample

240728-1tp3ys1eld
MD5

2659ed2cb4afab7a842b055f23ffd340
SHA1

509080204bd698f75f5096799f1bc7c13ecf79d9
SHA256

26d370fac05289d2d7895acb5ab970e500769b0fff27e5807a0edf36a662926f
SHA512

5819c6ffcd8b7ae10b2d7f5694eff3d1d19645273ae29d161e0a6ab975fa33b8d75268292c5d257c77172202afa38179127d46d1592c9ff7667523acc2186a1e
SSDEEP

24576:euYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:e9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  2659ed2cb4afab7a842b055f23ffd340_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  2659ed2cb4afab7a842b055f23ffd340
- SHA1
  
  509080204bd698f75f5096799f1bc7c13ecf79d9
- SHA256
  
  26d370fac05289d2d7895acb5ab970e500769b0fff27e5807a0edf36a662926f
- SHA512
  
  5819c6ffcd8b7ae10b2d7f5694eff3d1d19645273ae29d161e0a6ab975fa33b8d75268292c5d257c77172202afa38179127d46d1592c9ff7667523acc2186a1e
- SSDEEP
  
  24576:euYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:e9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan privilege_escalation
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan