Overview

overview

10

Static

static

3

525e592cad...40.dll

windows7-x64

10

525e592cad...40.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40

  • Size

    1.3MB

  • Sample

    241011-hzdm1a1dpb

  • MD5

    f84b2da4a842d7b705d104df3ff1dfac

  • SHA1

    bab36606ed69758eb3dc898583529bb0f6d3b46f

  • SHA256

    525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40

  • SHA512

    c91d9c63d5e95a1f2413a7236fc1c70a6d406c9b498740eb0d0fd25d1a568a17bef6bffd1ef724e2a553ebfc6f330fbbeda92ae837191e2d6967154ba957a7e7

  • SSDEEP

    12288:xXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:NB/Qn0rbD8UZUDtgIiemI51Mwtewkm

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40

    • Size

      1.3MB

    • MD5

      f84b2da4a842d7b705d104df3ff1dfac

    • SHA1

      bab36606ed69758eb3dc898583529bb0f6d3b46f

    • SHA256

      525e592cad025c414c14cee1bcbaeb3a3be1cd42390fc21ce7ef34e028824a40

    • SHA512

      c91d9c63d5e95a1f2413a7236fc1c70a6d406c9b498740eb0d0fd25d1a568a17bef6bffd1ef724e2a553ebfc6f330fbbeda92ae837191e2d6967154ba957a7e7

    • SSDEEP

      12288:xXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:NB/Qn0rbD8UZUDtgIiemI51Mwtewkm

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks