Overview

overview

10

Static

static

3

4d4735af8b...18.dll

windows7-x64

10

4d4735af8b...18.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4d4735af8b4bff7c28411a6c45ab0712_JaffaCakes118

  • Size

    1.1MB

  • Sample

    241016-rjwnbatcrg

  • MD5

    4d4735af8b4bff7c28411a6c45ab0712

  • SHA1

    29d2150c2481ad8422a6c89efea1eba372a59db0

  • SHA256

    84d3d619e2c19d65f1cd545a46284f1b0c8fed90e5e5ae3c2ea2c2fd8cd08dc3

  • SHA512

    fa3587957044c7e7140d5897c39ccbbfaf90db55f31ae70d1500c29d572c059d6be87aa13e6d4d2e5275607d11598f7e5d1b057010bc9e2c85a95f1daa933160

  • SSDEEP

    12288:RdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:/MIJxSDX3bqjhcfHk7MzH6z

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      4d4735af8b4bff7c28411a6c45ab0712_JaffaCakes118

    • Size

      1.1MB

    • MD5

      4d4735af8b4bff7c28411a6c45ab0712

    • SHA1

      29d2150c2481ad8422a6c89efea1eba372a59db0

    • SHA256

      84d3d619e2c19d65f1cd545a46284f1b0c8fed90e5e5ae3c2ea2c2fd8cd08dc3

    • SHA512

      fa3587957044c7e7140d5897c39ccbbfaf90db55f31ae70d1500c29d572c059d6be87aa13e6d4d2e5275607d11598f7e5d1b057010bc9e2c85a95f1daa933160

    • SSDEEP

      12288:RdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:/MIJxSDX3bqjhcfHk7MzH6z

    Score
    10/10
    dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks