dridex | e5fcac5911dd1633ceac928cc930e5041484bdb95ebb4dba5103d2add754f741 | Triage

Sharing

General

Target

334adbca3e999c94a0bffe4648723a0c_JaffaCakes118
Size

1.2MB
Sample

240729-cw679asfqb
MD5

334adbca3e999c94a0bffe4648723a0c
SHA1

2d7306300ac5a1664cb91635ab3c3d6f99b7d4bb
SHA256

e5fcac5911dd1633ceac928cc930e5041484bdb95ebb4dba5103d2add754f741
SHA512

f42d2a5fc6c89e6a897f1733d85fbd096b7c702ee92edf7b8182e60efe27cade4fb2ed62e95752fefe9b136f910ec63e7cad7f4ddff7492a2378880dc9ed3fbf
SSDEEP

24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  334adbca3e999c94a0bffe4648723a0c_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  334adbca3e999c94a0bffe4648723a0c
- SHA1
  
  2d7306300ac5a1664cb91635ab3c3d6f99b7d4bb
- SHA256
  
  e5fcac5911dd1633ceac928cc930e5041484bdb95ebb4dba5103d2add754f741
- SHA512
  
  f42d2a5fc6c89e6a897f1733d85fbd096b7c702ee92edf7b8182e60efe27cade4fb2ed62e95752fefe9b136f910ec63e7cad7f4ddff7492a2378880dc9ed3fbf
- SSDEEP
  
  24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan