Overview

overview

10

Static

static

3

daae9ef556...9d.dll

windows7-x64

10

daae9ef556...9d.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    daae9ef5569b1a800270b09adb162b719f77c0594a792c78220074945a1b9a9d

  • Size

    964KB

  • Sample

    241021-zysh7swgrc

  • MD5

    0dfedfa7857af79c50d589c2dc966f39

  • SHA1

    f60eb9042e405ccc3065b64cbae1e8f069c85edc

  • SHA256

    daae9ef5569b1a800270b09adb162b719f77c0594a792c78220074945a1b9a9d

  • SHA512

    1821ce0b21df31b09011fe9852b10de17fd0c440ba861cbec712206c6a9663a5d49302acb70cff9d79cd532a18feb0dffe179253ee9f49156f479de43ea37ebf

  • SSDEEP

    12288:xfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4skZIy:RdAE81W381Wk8jnYz3dsPEb4s9

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      daae9ef5569b1a800270b09adb162b719f77c0594a792c78220074945a1b9a9d

    • Size

      964KB

    • MD5

      0dfedfa7857af79c50d589c2dc966f39

    • SHA1

      f60eb9042e405ccc3065b64cbae1e8f069c85edc

    • SHA256

      daae9ef5569b1a800270b09adb162b719f77c0594a792c78220074945a1b9a9d

    • SHA512

      1821ce0b21df31b09011fe9852b10de17fd0c440ba861cbec712206c6a9663a5d49302acb70cff9d79cd532a18feb0dffe179253ee9f49156f479de43ea37ebf

    • SSDEEP

      12288:xfndx6M581WsGRouyjzC6gn5l0H1Tak8jnGg/xeq7gz3xfsPEb4skZIy:RdAE81W381Wk8jnYz3dsPEb4s9

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks