dridex | a6db43ae471602cfbfd5321b0536f3afcc8b0314e54768fa4f593303193a7337 | Triage

Sharing

General

Target

060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118
Size

1.2MB
Sample

240728-c1ry5awgka
MD5

060a84bec4029d28ef32d2da09fb89f0
SHA1

01e4f103c7a644f11551433cd78daacb6fa120f2
SHA256

a6db43ae471602cfbfd5321b0536f3afcc8b0314e54768fa4f593303193a7337
SHA512

3e558efe6d582d27f042bcdda3b63c5075217a4cc1107474686c08fdac08d673c168bd61c1effe81e90d66401d3f5b75a15e61bb26a6af5fad4fc88d26ef1b0d
SSDEEP

24576:zuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:99cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  060a84bec4029d28ef32d2da09fb89f0_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  060a84bec4029d28ef32d2da09fb89f0
- SHA1
  
  01e4f103c7a644f11551433cd78daacb6fa120f2
- SHA256
  
  a6db43ae471602cfbfd5321b0536f3afcc8b0314e54768fa4f593303193a7337
- SHA512
  
  3e558efe6d582d27f042bcdda3b63c5075217a4cc1107474686c08fdac08d673c168bd61c1effe81e90d66401d3f5b75a15e61bb26a6af5fad4fc88d26ef1b0d
- SSDEEP
  
  24576:zuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:99cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan