dridex | 055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded | Triage

Sharing

General

Target

055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
Size

776KB
Sample

241219-yksflsymfn
MD5

5275646a6840ccb66702495f74f2bcb1
SHA1

7914b808819e702bc2d457de368310d19496e7dc
SHA256

055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
SHA512

2ac366a058c1800216e623cce710cc1c42fb942e304365ba9a7eb6b8e6000c7ba2d639210e1f5bf4927243105edf105ee5d3913fe936df68ee0a9270f670c31f
SSDEEP

24576:pWyonFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:EHuVMK6vx2RsIKNrj

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Targets

- Target
  
  055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
- Size
  
  776KB
- MD5
  
  5275646a6840ccb66702495f74f2bcb1
- SHA1
  
  7914b808819e702bc2d457de368310d19496e7dc
- SHA256
  
  055334a15a5473829f0ee5d7e2695ddd6be6e87e1eaeab9b2bbdc2571dec8ded
- SHA512
  
  2ac366a058c1800216e623cce710cc1c42fb942e304365ba9a7eb6b8e6000c7ba2d639210e1f5bf4927243105edf105ee5d3913fe936df68ee0a9270f670c31f
- SSDEEP
  
  24576:pWyonFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:EHuVMK6vx2RsIKNrj
Score

10^/10

dridex botnet evasion payload persistence trojan
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetevasionpayloadpersistencetrojan