dridex | d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df | Triage

Sharing

General

Target

d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df.exe
Size

768KB
Sample

241203-emxnkavmgq
MD5

778f2d03f6cc98beaa08661134555c8d
SHA1

0ffa709507e15bd9d1359a227e750c7f53651754
SHA256

d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df
SHA512

c664eec09008a98da234009e49465777b0112ef7d41fcf40aa88d7aa04fe49d067bc0f1d27e5d75d05c07dabbeab4e7a288d97f7b40684a1867d2854aea90e2b
SSDEEP

12288:66BBWGJW6eC85Df97+yXUj7SncCxj8iHGo59S1WQSCtEdFO7YKJf6t:66BQBjlc728jo7S1bl6FbKG

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df.exe
- Size
  
  768KB
- MD5
  
  778f2d03f6cc98beaa08661134555c8d
- SHA1
  
  0ffa709507e15bd9d1359a227e750c7f53651754
- SHA256
  
  d8e2f42b160e555fde80597cbf093a4f89bb25a7b36ec08fd6739141107664df
- SHA512
  
  c664eec09008a98da234009e49465777b0112ef7d41fcf40aa88d7aa04fe49d067bc0f1d27e5d75d05c07dabbeab4e7a288d97f7b40684a1867d2854aea90e2b
- SSDEEP
  
  12288:66BBWGJW6eC85Df97+yXUj7SncCxj8iHGo59S1WQSCtEdFO7YKJf6t:66BQBjlc728jo7S1bl6FbKG
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan