Overview

overview

10

Static

static

3

dbfc91b3d6...88.dll

windows7-x64

10

dbfc91b3d6...88.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88

  • Size

    944KB

  • Sample

    241011-tkmsxa1bpe

  • MD5

    dc4b3d40467b02484bead9b93e12862a

  • SHA1

    2fa0d80d3ee72fbbe3a4c35c8ffc964f47449b4b

  • SHA256

    dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88

  • SHA512

    de790f5c7fe3f32e19ea7eecc0d6fc0476d95dae957a06fa6b4a409c5f421a37d50d788787558d99496ad26590209bc226257bb9b0916dd6bbe0d03413c53286

  • SSDEEP

    12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88

    • Size

      944KB

    • MD5

      dc4b3d40467b02484bead9b93e12862a

    • SHA1

      2fa0d80d3ee72fbbe3a4c35c8ffc964f47449b4b

    • SHA256

      dbfc91b3d66277b0c4c3ed7416f89b8e42ee567a6758596fccb112540ab7ab88

    • SHA512

      de790f5c7fe3f32e19ea7eecc0d6fc0476d95dae957a06fa6b4a409c5f421a37d50d788787558d99496ad26590209bc226257bb9b0916dd6bbe0d03413c53286

    • SSDEEP

      12288:YPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:YtKTrsKSKBTSb6DUXWq8

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks