dridex | 2483394b81137cb8a95584ee70556b2624b4ec757cea17624f2b17b8c975e3c6 | Triage

Sharing

General

Target

c3f2ded942c2442b77fd47ce652bb792_JaffaCakes118
Size

1.2MB
Sample

240826-2qv1gazajb
MD5

c3f2ded942c2442b77fd47ce652bb792
SHA1

b411d07b595927f4ff541b513faca778a85d38f3
SHA256

2483394b81137cb8a95584ee70556b2624b4ec757cea17624f2b17b8c975e3c6
SHA512

0926a6344d42a0f09262a7ce2e1b99f7009f8ab01b897dfde65a7e2df7e0ab192fd6f6d7b353303c10114e83d5d3d926cbd5c94e4f3ddf05b1a16231b3819977
SSDEEP

24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  c3f2ded942c2442b77fd47ce652bb792_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  c3f2ded942c2442b77fd47ce652bb792
- SHA1
  
  b411d07b595927f4ff541b513faca778a85d38f3
- SHA256
  
  2483394b81137cb8a95584ee70556b2624b4ec757cea17624f2b17b8c975e3c6
- SHA512
  
  0926a6344d42a0f09262a7ce2e1b99f7009f8ab01b897dfde65a7e2df7e0ab192fd6f6d7b353303c10114e83d5d3d926cbd5c94e4f3ddf05b1a16231b3819977
- SSDEEP
  
  24576:iuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:q9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan privilege_escalation
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan