dridex | f487a0f3b8ef34854390d1f67b57ead543c6a940a74bf00699264c183533cbe6 | Triage

Sharing

General

Target

b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118
Size

1.2MB
Sample

240821-hf9akavalc
MD5

b273fa97431153c131b5b9ae8d6f85b7
SHA1

6747bd7ef216cdf6d23e500c2ca8c41e851b109e
SHA256

f487a0f3b8ef34854390d1f67b57ead543c6a940a74bf00699264c183533cbe6
SHA512

6bc9e750e65ae49fa76d6fc1447b3386c79cf434871e75a5b6f2307ccd35b9105c8b6e5eafd610e618ce36ac4089cecd2c739ed05cb9bf9944327b40fcbc2e1c
SSDEEP

24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  b273fa97431153c131b5b9ae8d6f85b7_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  b273fa97431153c131b5b9ae8d6f85b7
- SHA1
  
  6747bd7ef216cdf6d23e500c2ca8c41e851b109e
- SHA256
  
  f487a0f3b8ef34854390d1f67b57ead543c6a940a74bf00699264c183533cbe6
- SHA512
  
  6bc9e750e65ae49fa76d6fc1447b3386c79cf434871e75a5b6f2307ccd35b9105c8b6e5eafd610e618ce36ac4089cecd2c739ed05cb9bf9944327b40fcbc2e1c
- SSDEEP
  
  24576:GuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:m9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan privilege_escalation
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan