dridex | c4a179d204f7bb7c4f82d2c0878c3f5cb9ca17fb519dd3b7447e4c3c5b327019 | Triage

Sharing

General

Target

f215b4fabb14768f115195da3c9dad3a_JaffaCakes118
Size

1.2MB
Sample

240922-qdqpfa1dlk
MD5

f215b4fabb14768f115195da3c9dad3a
SHA1

8977086bad5f310504bf0c61f36f096f2cb7644b
SHA256

c4a179d204f7bb7c4f82d2c0878c3f5cb9ca17fb519dd3b7447e4c3c5b327019
SHA512

d88438ee561f9d21017f2099b915cf4b5fd4f03b58bf8b139b721b558f41f061b923e564c5fbb9570c5c1337b986810df91de4a7bb2b7dc160c5c5f6022681ca
SSDEEP

24576:AuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nfpt:Q9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  f215b4fabb14768f115195da3c9dad3a_JaffaCakes118
- Size
  
  1.2MB
- MD5
  
  f215b4fabb14768f115195da3c9dad3a
- SHA1
  
  8977086bad5f310504bf0c61f36f096f2cb7644b
- SHA256
  
  c4a179d204f7bb7c4f82d2c0878c3f5cb9ca17fb519dd3b7447e4c3c5b327019
- SHA512
  
  d88438ee561f9d21017f2099b915cf4b5fd4f03b58bf8b139b721b558f41f061b923e564c5fbb9570c5c1337b986810df91de4a7bb2b7dc160c5c5f6022681ca
- SSDEEP
  
  24576:AuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nfpt:Q9cKrUqZWLAcU
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan