dridex | cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed | Triage

Sharing

General

Target

0880db875d3faf856245d738b7e0a25a_JaffaCakes118
Size

2.4MB
Sample

241002-c9ncastbmk
MD5

0880db875d3faf856245d738b7e0a25a
SHA1

38d0242a90bdc46d7cf3bf3a1b5e0013c23ba0a1
SHA256

cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed
SHA512

8696984083fcbe4426976bcb9d6793f6d8653572f747e5095c5413a4ea60a985d54c6fc421a6622d0e3a66b1c4df8069aafc39f2ab88c0aecfbe9f4fed1a56e1
SSDEEP

12288:yQVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1AZ:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  0880db875d3faf856245d738b7e0a25a_JaffaCakes118
- Size
  
  2.4MB
- MD5
  
  0880db875d3faf856245d738b7e0a25a
- SHA1
  
  38d0242a90bdc46d7cf3bf3a1b5e0013c23ba0a1
- SHA256
  
  cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed
- SHA512
  
  8696984083fcbe4426976bcb9d6793f6d8653572f747e5095c5413a4ea60a985d54c6fc421a6622d0e3a66b1c4df8069aafc39f2ab88c0aecfbe9f4fed1a56e1
- SSDEEP
  
  12288:yQVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1AZ:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan