Overview

overview

10

Static

static

3

e661ee88d2...f8.dll

windows7-x64

10

e661ee88d2...f8.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

  • Size

    1.3MB

  • Sample

    241012-cj16gaxamg

  • MD5

    c1149d0d1cd46a9b3eb35371b41c4a63

  • SHA1

    9001ee8245fd45cfdf537afc41cdf6338fe66928

  • SHA256

    e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

  • SHA512

    448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba

  • SSDEEP

    12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

    • Size

      1.3MB

    • MD5

      c1149d0d1cd46a9b3eb35371b41c4a63

    • SHA1

      9001ee8245fd45cfdf537afc41cdf6338fe66928

    • SHA256

      e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

    • SHA512

      448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba

    • SSDEEP

      12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks