dridex | 3b2d01d04f1d9eac4c480c16befd364cdd797febe47b96ad4a78380af63cf33f | Triage

Sharing

General

Target

2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118
Size

1.2MB
Sample

240729-a57t2aydkg
MD5

2eba1f3e3c4d522681391430b61ebf5e
SHA1

fa261d032dff878e2b05185a88ff061f2ad8cc79
SHA256

3b2d01d04f1d9eac4c480c16befd364cdd797febe47b96ad4a78380af63cf33f
SHA512

e35975deb8ec44d47cff6ca13407511b8dca41706069ab975c28e8f606c62b908e7e6c8298e0e975a4cb4f816f4314de895e6065eea819351384e6023227bf33
SSDEEP

24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  2eba1f3e3c4d522681391430b61ebf5e_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  2eba1f3e3c4d522681391430b61ebf5e
- SHA1
  
  fa261d032dff878e2b05185a88ff061f2ad8cc79
- SHA256
  
  3b2d01d04f1d9eac4c480c16befd364cdd797febe47b96ad4a78380af63cf33f
- SHA512
  
  e35975deb8ec44d47cff6ca13407511b8dca41706069ab975c28e8f606c62b908e7e6c8298e0e975a4cb4f816f4314de895e6065eea819351384e6023227bf33
- SSDEEP
  
  24576:2uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:29cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan