Overview

overview

10

Static

static

3

1a8536a5bb...20.dll

windows7-x64

10

1a8536a5bb...20.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020

  • Size

    940KB

  • Sample

    241011-rh95bawfle

  • MD5

    a0cb297fd3181bda59066db2281fb496

  • SHA1

    7ba6d4a54cd899bf575da748def486be7dffc70d

  • SHA256

    1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020

  • SHA512

    3ace28434cf67dcda52b3f6f7bacf03f97e92d76e4d0b69f9e3759c50f0b236f0e673b396a2b255706864bf25409212eafde50ac6374155f2c15c856bcd87390

  • SSDEEP

    12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020

    • Size

      940KB

    • MD5

      a0cb297fd3181bda59066db2281fb496

    • SHA1

      7ba6d4a54cd899bf575da748def486be7dffc70d

    • SHA256

      1a8536a5bb678f5273e7995d810ef105a82d062219e09a7b6f4b632e2532b020

    • SHA512

      3ace28434cf67dcda52b3f6f7bacf03f97e92d76e4d0b69f9e3759c50f0b236f0e673b396a2b255706864bf25409212eafde50ac6374155f2c15c856bcd87390

    • SSDEEP

      12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks