Overview

overview

10

Static

static

3

Trojan.Win...BM.dll

windows7-x64

10

Trojan.Win...BM.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Trojan.Win64.Dridex.ABM.MTB-b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2-NeikiAnalytics

  • Size

    984KB

  • Sample

    240915-shhkqszfmq

  • MD5

    5b4ed52afad791ec0dc42503eb380110

  • SHA1

    51da3175f1952b77a4cbe7d5f25651cebf663d13

  • SHA256

    b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2

  • SHA512

    49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac

  • SSDEEP

    12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      Trojan.Win64.Dridex.ABM.MTB-b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2-NeikiAnalytics

    • Size

      984KB

    • MD5

      5b4ed52afad791ec0dc42503eb380110

    • SHA1

      51da3175f1952b77a4cbe7d5f25651cebf663d13

    • SHA256

      b221e9990a3e37c98a73e407516a06c0905a6f5cdfb04b0acadb49448c62edd2

    • SHA512

      49814de8778b86ab5f79f03aa860db320fbf58975855740bd1306a67857256b1f360479a75ce7d0962102d7ffdb3f32d93084ac6ce66a190fa7091476f0ebcac

    • SSDEEP

      12288:Ufndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:+dAE81W381Wk8jnYz3dsPEb4s

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks