Overview

overview

10

Static

static

3

b9414ec1a9...1f.dll

windows7-x64

10

b9414ec1a9...1f.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f

  • Size

    692KB

  • Sample

    241016-t6hq3szdmh

  • MD5

    c2b6f8ebb1dd8692d134ed9dd9891cfa

  • SHA1

    1a1eb14433d4be1fb5e464c913a478f286fbf991

  • SHA256

    b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f

  • SHA512

    a6a938cdb0718f6757cffbf122d7f36420b78a20df3727872469c8f4bacf131d5ea596c90b148771e95c89cf9ccc10388f36e19098e491c1dbc0a96ff563befe

  • SSDEEP

    12288:wqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:wqGBHTxvt+g2gYed

Score
10/10
dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f

    • Size

      692KB

    • MD5

      c2b6f8ebb1dd8692d134ed9dd9891cfa

    • SHA1

      1a1eb14433d4be1fb5e464c913a478f286fbf991

    • SHA256

      b9414ec1a9551702c1248ce53e3b9f80fd023fb0393c957f3cc949dfcdfcb11f

    • SHA512

      a6a938cdb0718f6757cffbf122d7f36420b78a20df3727872469c8f4bacf131d5ea596c90b148771e95c89cf9ccc10388f36e19098e491c1dbc0a96ff563befe

    • SSDEEP

      12288:wqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:wqGBHTxvt+g2gYed

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojanprivilege_escalation

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks