dridex | 38d90b577fe406506b98dcfa44671fb4623e64a226880bbf52658901e4c9bf0e | Triage

Submit
Reports

Overview

overview

Static

static

3

aabbda269f...18.dll

windows7-x64

aabbda269f...18.dll

windows10-2004-x64

Sharing

General

Target

aabbda269fc690bf1270e2f2a727030f_JaffaCakes118
Size

1.2MB
Sample

240819-m2pkhazfjg
MD5

aabbda269fc690bf1270e2f2a727030f
SHA1

1169a82250440dc8ce225e7f936c47e05b1b858e
SHA256

38d90b577fe406506b98dcfa44671fb4623e64a226880bbf52658901e4c9bf0e
SHA512

e524f3c97d7492ffadfac9fdb6e5adcf90d9583e8c9262544757fa43902f715656c14c7ae33f1982930e454174dc703bc24bd4a963aa1479de992bb93b39fee8
SSDEEP

24576:nuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NGpt:J9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

aabbda269fc690bf1270e2f2a727030f_JaffaCakes118.dll

Resource

win7-20240729-en

dridex botnet evasion payload persistence trojan

windows7-x64

9 signatures

150 seconds

Behavioral task

behavioral2

Sample

aabbda269fc690bf1270e2f2a727030f_JaffaCakes118.dll

Resource

win10v2004-20240802-en

dridex botnet evasion payload persistence trojan

windows10-2004-x64

18 signatures

150 seconds

Malware Config

Targets

- Target
  
  aabbda269fc690bf1270e2f2a727030f_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  aabbda269fc690bf1270e2f2a727030f
- SHA1
  
  1169a82250440dc8ce225e7f936c47e05b1b858e
- SHA256
  
  38d90b577fe406506b98dcfa44671fb4623e64a226880bbf52658901e4c9bf0e
- SHA512
  
  e524f3c97d7492ffadfac9fdb6e5adcf90d9583e8c9262544757fa43902f715656c14c7ae33f1982930e454174dc703bc24bd4a963aa1479de992bb93b39fee8
- SSDEEP
  
  24576:nuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NGpt:J9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan

© 2018-2024

Terms | Privacy