Overview

overview

10

Static

static

3

875b2e19f2...c7.dll

windows7-x64

10

875b2e19f2...c7.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    875b2e19f2f6be613a643c4e600e1b822157499ad3b4c62cdf4aeae1666fecc7

  • Size

    688KB

  • Sample

    241021-zysh7swgqg

  • MD5

    5d441694a83f37144335ccf6cf3ef79b

  • SHA1

    089139f16273ec4b133c70e0d8d92348667778b6

  • SHA256

    875b2e19f2f6be613a643c4e600e1b822157499ad3b4c62cdf4aeae1666fecc7

  • SHA512

    eaabc984daa73b210ffcb1a78f4812b5186d6be9f9e7e19899b98fea0f5f3fb8653d507325020b08215cdcbd7b7cf05f66a8aa78a975a1e6117f62c60446f3f5

  • SSDEEP

    12288:Gfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:odAE81W381Wk8jnYz3dsPEb4s

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      875b2e19f2f6be613a643c4e600e1b822157499ad3b4c62cdf4aeae1666fecc7

    • Size

      688KB

    • MD5

      5d441694a83f37144335ccf6cf3ef79b

    • SHA1

      089139f16273ec4b133c70e0d8d92348667778b6

    • SHA256

      875b2e19f2f6be613a643c4e600e1b822157499ad3b4c62cdf4aeae1666fecc7

    • SHA512

      eaabc984daa73b210ffcb1a78f4812b5186d6be9f9e7e19899b98fea0f5f3fb8653d507325020b08215cdcbd7b7cf05f66a8aa78a975a1e6117f62c60446f3f5

    • SSDEEP

      12288:Gfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4sk:odAE81W381Wk8jnYz3dsPEb4s

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks