Overview

overview

10

Static

static

3

dc2d104b67...18.dll

windows7-x64

10

dc2d104b67...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dc2d104b67fcae0ddd6dc0e18b8faaeb_JaffaCakes118

  • Size

    1.2MB

  • Sample

    240912-ltff7a1ejd

  • MD5

    dc2d104b67fcae0ddd6dc0e18b8faaeb

  • SHA1

    7e2e76bdcd59fa3a06550be0cf8765368cb1c3ad

  • SHA256

    acb6b390306be1fe78e2453843386ac52bf9599741957edd013e9c5ea276e467

  • SHA512

    d61af34102337e7e34f663471c0b8d97887fc275921ef23465cfc105ac1288087ef2e7908b2d3382b1a3564bdd1e0f37f542cc415824f6b5107999a2cfaf5cd8

  • SSDEEP

    24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:s9cKrUqZWLAcU

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      dc2d104b67fcae0ddd6dc0e18b8faaeb_JaffaCakes118

    • Size

      1.2MB

    • MD5

      dc2d104b67fcae0ddd6dc0e18b8faaeb

    • SHA1

      7e2e76bdcd59fa3a06550be0cf8765368cb1c3ad

    • SHA256

      acb6b390306be1fe78e2453843386ac52bf9599741957edd013e9c5ea276e467

    • SHA512

      d61af34102337e7e34f663471c0b8d97887fc275921ef23465cfc105ac1288087ef2e7908b2d3382b1a3564bdd1e0f37f542cc415824f6b5107999a2cfaf5cd8

    • SSDEEP

      24576:0uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:s9cKrUqZWLAcU

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks