Overview

overview

10

Static

static

3

bb17e954d0...74.dll

windows7-x64

10

bb17e954d0...74.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774

  • Size

    936KB

  • Sample

    241011-y9mlnascqh

  • MD5

    401f84a3215161405db7ecf1f1d0b6f4

  • SHA1

    7b2517a60daac43ab7d5f12f3c5f10c40221c46d

  • SHA256

    bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774

  • SHA512

    3b4598da32edd45909e44067d8fd0aa65a30d21deb908c2ba0a7e2ee1f1d9b4e362161238c47305fecfd36f38a99da9d39d0f1e242ae337d8fc4525eac96b183

  • SSDEEP

    12288:3PVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:3tKTrsKSKBTSb6DUXWq8

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774

    • Size

      936KB

    • MD5

      401f84a3215161405db7ecf1f1d0b6f4

    • SHA1

      7b2517a60daac43ab7d5f12f3c5f10c40221c46d

    • SHA256

      bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774

    • SHA512

      3b4598da32edd45909e44067d8fd0aa65a30d21deb908c2ba0a7e2ee1f1d9b4e362161238c47305fecfd36f38a99da9d39d0f1e242ae337d8fc4525eac96b183

    • SSDEEP

      12288:3PVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:3tKTrsKSKBTSb6DUXWq8

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks