Overview

overview

10

Static

static

3

3387ab8c64...1N.dll

windows7-x64

10

3387ab8c64...1N.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3387ab8c645e540ee7bb8aa34472eaecc30897cb8ab02d48524363c5f32b29b1N.exe

  • Size

    656KB

  • Sample

    250216-rgy1naznfz

  • MD5

    1f2a1f289e9b564ff7304ec7fb0bfd20

  • SHA1

    6b01c8afb672c36e5ee58f5da198d2ecd21df703

  • SHA256

    3387ab8c645e540ee7bb8aa34472eaecc30897cb8ab02d48524363c5f32b29b1

  • SHA512

    e5842e81e6567ea2f96bad72bf789a20be920d32bd92151d51cca5bfdb5407d999f79c515e48dcbaff42ae139162d5a1110ae531a6ea358f3b5f9d19646de953

  • SSDEEP

    6144:Xg12AzW5HsiScvtNybiR8g0ISTFCRVe9/JE+++sKS1JGWWsca65eu9K2zqc4CWAZ:X82AK5HOEksJ1YW7DwzqyQ

Score
10/10
dridexbotnetdefense_evasiondiscoveryloaderpersistencetrojan

Malware Config

Targets

    • Target

      3387ab8c645e540ee7bb8aa34472eaecc30897cb8ab02d48524363c5f32b29b1N.exe

    • Size

      656KB

    • MD5

      1f2a1f289e9b564ff7304ec7fb0bfd20

    • SHA1

      6b01c8afb672c36e5ee58f5da198d2ecd21df703

    • SHA256

      3387ab8c645e540ee7bb8aa34472eaecc30897cb8ab02d48524363c5f32b29b1

    • SHA512

      e5842e81e6567ea2f96bad72bf789a20be920d32bd92151d51cca5bfdb5407d999f79c515e48dcbaff42ae139162d5a1110ae531a6ea358f3b5f9d19646de953

    • SSDEEP

      6144:Xg12AzW5HsiScvtNybiR8g0ISTFCRVe9/JE+++sKS1JGWWsca65eu9K2zqc4CWAZ:X82AK5HOEksJ1YW7DwzqyQ

    Score
    10/10
    dridexbotnetdefense_evasiondiscoveryloaderpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex family

      dridex

    • Dridex Loader 'dmod' strings

      Detects 'dmod' strings in Dridex loader.

      botnetloader

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Checks whether UAC is enabled

      defense_evasiontrojan

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks