dridex | a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd | Triage

Submit
Reports

Overview

overview

Static

static

3

a13857d5df...fd.dll

windows7-x64

a13857d5df...fd.dll

windows10-2004-x64

Sharing

General

Target

a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
Size

676KB
Sample

241102-dg72nsyaqc
MD5

3a326af7f81639f667ee14de69537a21
SHA1

66c8fed72543d4c155411dc08dd21e615e2dec8d
SHA256

a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
SHA512

15c4efe13cfedba6e9def41216acb062cae4ae59338c1878ce97507c980b771c2b332d34885ece2444e0210e7f21e79cbbb57ecf1a111e3e0f8939749c27de4f
SSDEEP

6144:R34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTa:RIKp/UWCZdCDh2IZDwAFRpR6Au

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll

Resource

win7-20240903-en

dridex botnet evasion payload persistence trojan

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd.dll

Resource

win10v2004-20241007-en

dridex botnet evasion payload persistence privilege_escalation trojan

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
- Size
  
  676KB
- MD5
  
  3a326af7f81639f667ee14de69537a21
- SHA1
  
  66c8fed72543d4c155411dc08dd21e615e2dec8d
- SHA256
  
  a13857d5df595b8238d68d39bd116e7a78d3ef19ee2644bd1ce4f498b8cbdffd
- SHA512
  
  15c4efe13cfedba6e9def41216acb062cae4ae59338c1878ce97507c980b771c2b332d34885ece2444e0210e7f21e79cbbb57ecf1a111e3e0f8939749c27de4f
- SSDEEP
  
  6144:R34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTa:RIKp/UWCZdCDh2IZDwAFRpR6Au
Score

10^/10

dridex botnet evasion payload persistence trojan privilege_escalation
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Dridex payload
  Detects Dridex x64 core DLL in memory.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Event Triggered Execution

Accessibility Features

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistenceprivilege_escalationtrojan

© 2018-2024

Terms | Privacy