Overview

overview

10

Static

static

3

4ac846154d...49.dll

windows7-x64

10

4ac846154d...49.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549

  • Size

    700KB

  • Sample

    241022-ak94navfqe

  • MD5

    bfbcb9e4b4723629dda33d1406a87d3a

  • SHA1

    d342007297faf30e3cd1a703b31287e735470858

  • SHA256

    4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549

  • SHA512

    d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41

  • SSDEEP

    12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549

    • Size

      700KB

    • MD5

      bfbcb9e4b4723629dda33d1406a87d3a

    • SHA1

      d342007297faf30e3cd1a703b31287e735470858

    • SHA256

      4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549

    • SHA512

      d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41

    • SSDEEP

      12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Dridex payload

      Detects Dridex x64 core DLL in memory.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks