dridex | 5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93 | Triage

Sharing

General

Target

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
Size

788KB
Sample

250116-bgmdvstla1
MD5

57ff8aad6421b8785d191a75825a457d
SHA1

7991ebfc143d958342135a84297ee949ef110f2a
SHA256

5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
SHA512

ec22ac2a7f68eb08b253a75efa75ca5d7dda6c726bc24f799556dd88f1347066c9a36ee683c8e77fef0cc42b0a86c4cbd6caabcf432134b63e815601b76fb908
SSDEEP

24576:9WyoyFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:oSuVMK6vx2RsIKNrj

Score

10^/10

dridex botnet discovery evasion payload persistence trojan

Malware Config

Targets

- Target
  
  5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
- Size
  
  788KB
- MD5
  
  57ff8aad6421b8785d191a75825a457d
- SHA1
  
  7991ebfc143d958342135a84297ee949ef110f2a
- SHA256
  
  5c31a1991b83b16d620785baf2e328b49cc684886f0682cfefc934c0f8762e93
- SHA512
  
  ec22ac2a7f68eb08b253a75efa75ca5d7dda6c726bc24f799556dd88f1347066c9a36ee683c8e77fef0cc42b0a86c4cbd6caabcf432134b63e815601b76fb908
- SSDEEP
  
  24576:9WyoyFMVMKkN3ZvxEhb0IsaQ4KriCo0j6Ij:oSuVMK6vx2RsIKNrj
Score

10^/10

dridex botnet evasion payload persistence trojan discovery
- Dridex
  Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
  botnet dridex
- Dridex family
  dridex
- Dridex Shellcode
  Detects Dridex Payload shellcode injected in Explorer process.
  botnet payload
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

dridexbotnetevasionpayloadpersistencetrojan

behavioral2

dridexbotnetdiscoveryevasionpayloadpersistencetrojan