dridex | 93a7f33ada113348eb0f47f7ceead4589b4878c7408e91f95691d5c5c68ceac6 | Triage

Sharing

General

Target

9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118
Size

1.2MB
Sample

240813-yfp5pasfrd
MD5

9479aa71f97c0fbd162719ab490fda2e
SHA1

4f043465c45e51d782522abee19fd9becd6b166f
SHA256

93a7f33ada113348eb0f47f7ceead4589b4878c7408e91f95691d5c5c68ceac6
SHA512

a52b69cf5e118c3ea7bfe4e6e818cd878616012153ca1d3979d449249ede3f12131f4cf9c862efc2f46c3f665672eb5d130b00336935c41dd657c813bd1b9c91
SSDEEP

24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  9479aa71f97c0fbd162719ab490fda2e_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  9479aa71f97c0fbd162719ab490fda2e
- SHA1
  
  4f043465c45e51d782522abee19fd9becd6b166f
- SHA256
  
  93a7f33ada113348eb0f47f7ceead4589b4878c7408e91f95691d5c5c68ceac6
- SHA512
  
  a52b69cf5e118c3ea7bfe4e6e818cd878616012153ca1d3979d449249ede3f12131f4cf9c862efc2f46c3f665672eb5d130b00336935c41dd657c813bd1b9c91
- SSDEEP
  
  24576:guYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:w9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan