dridex | 4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549 | Triage

Submit
Reports

Overview

overview

Static

static

3

4ac846154d...49.dll

windows7-x64

4ac846154d...49.dll

windows10-2004-x64

Sharing

General

Target

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
Size

700KB
Sample

241022-ajg2gsxclp
MD5

bfbcb9e4b4723629dda33d1406a87d3a
SHA1

d342007297faf30e3cd1a703b31287e735470858
SHA256

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
SHA512

d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41
SSDEEP

12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll

Resource

win7-20240903-en

dridex botnet evasion payload persistence privilege_escalation trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll

Resource

win10v2004-20241007-en

dridex botnet evasion payload persistence trojan

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
- Size
  
  700KB
- MD5
  
  bfbcb9e4b4723629dda33d1406a87d3a
- SHA1
  
  d342007297faf30e3cd1a703b31287e735470858
- SHA256
  
  4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
- SHA512
  
  d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41
- SSDEEP
  
  12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo
Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Dridex payload
  Detects Dridex x64 core DLL in memory.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan

© 2018-2024

Terms | Privacy