Overview

overview

10

Static

static

3

b7145f389f...4c.dll

windows7-x64

10

b7145f389f...4c.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b7145f389fc79052d20e54ce49b5b51194dccd385e08850eb11dc068d6ba6e4c

  • Size

    940KB

  • Sample

    241011-cjwkzsvfjp

  • MD5

    6767a3a501338fa1e0d20387797baa25

  • SHA1

    3b3b1b8514899ce981e091b1f10c5981e2276e39

  • SHA256

    b7145f389fc79052d20e54ce49b5b51194dccd385e08850eb11dc068d6ba6e4c

  • SHA512

    8571d5e0b210cac49012909d6e326b5bfd47718f115d63c23f540ff79a9d32f7bb1ada10d5b65248d99a7789eadbd4db823fe40dfffbbdc4af6c67affe431118

  • SSDEEP

    12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      b7145f389fc79052d20e54ce49b5b51194dccd385e08850eb11dc068d6ba6e4c

    • Size

      940KB

    • MD5

      6767a3a501338fa1e0d20387797baa25

    • SHA1

      3b3b1b8514899ce981e091b1f10c5981e2276e39

    • SHA256

      b7145f389fc79052d20e54ce49b5b51194dccd385e08850eb11dc068d6ba6e4c

    • SHA512

      8571d5e0b210cac49012909d6e326b5bfd47718f115d63c23f540ff79a9d32f7bb1ada10d5b65248d99a7789eadbd4db823fe40dfffbbdc4af6c67affe431118

    • SSDEEP

      12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks