Overview

overview

10

Static

static

3

642f7b6daf...f9.dll

windows7-x64

10

642f7b6daf...f9.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9

  • Size

    900KB

  • Sample

    241014-vx4gvswhjb

  • MD5

    42b74b886c2d75ff9bf4636e558d7ee2

  • SHA1

    096a9d095b93fd378afdc04e04f0d82d23320b3d

  • SHA256

    642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9

  • SHA512

    688ad13892a5e66726574759fd21579887e2452b54397682a81643735ef050dd4fc4a8d152183802ad7f15f80eb2cdf889aa67a1b9050dcfd813cad00b363c78

  • SSDEEP

    12288:CqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed1aaw6:CqGBHTxvt+g2gYed1

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9

    • Size

      900KB

    • MD5

      42b74b886c2d75ff9bf4636e558d7ee2

    • SHA1

      096a9d095b93fd378afdc04e04f0d82d23320b3d

    • SHA256

      642f7b6daf911406a48014ce3cb624d1980ed73a5ace4439de573ff2791043f9

    • SHA512

      688ad13892a5e66726574759fd21579887e2452b54397682a81643735ef050dd4fc4a8d152183802ad7f15f80eb2cdf889aa67a1b9050dcfd813cad00b363c78

    • SSDEEP

      12288:CqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed1aaw6:CqGBHTxvt+g2gYed1

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks