dridex | 7126dd06985d20a9411b370715973a5eda642003567fe11aed9848cd25cea415 | Triage

Sharing

General

Target

d69063a86c406e82e46e5747e5ef8794_JaffaCakes118
Size

1.2MB
Sample

240909-shcdqavanr
MD5

d69063a86c406e82e46e5747e5ef8794
SHA1

55511b528dd91aa2b5fc7cd24916103a9ad24a5f
SHA256

7126dd06985d20a9411b370715973a5eda642003567fe11aed9848cd25cea415
SHA512

1b9a3def2cb145cc645828a7880b76781c25bf8ef8bf66f0c167fb9ccd924400a86b6cb2e51725b6d4297b75825291053d0e97edbc60d109b7d4f66681b881dd
SSDEEP

24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  d69063a86c406e82e46e5747e5ef8794_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  d69063a86c406e82e46e5747e5ef8794
- SHA1
  
  55511b528dd91aa2b5fc7cd24916103a9ad24a5f
- SHA256
  
  7126dd06985d20a9411b370715973a5eda642003567fe11aed9848cd25cea415
- SHA512
  
  1b9a3def2cb145cc645828a7880b76781c25bf8ef8bf66f0c167fb9ccd924400a86b6cb2e51725b6d4297b75825291053d0e97edbc60d109b7d4f66681b881dd
- SSDEEP
  
  24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan