Extracted

• • Target
    Simplydisk_TPEB_Tariff_CtoC_16082021_Rev_2_74317.xlsm
  • Size 258KB
  • SHA256 7a6e7bd25e49ab0c5fdeae608fc79ae61a24f9d6048a8dc2e4cc48cf212acdf8
  • MD5 576fac94cc5f39cebf281fb795c928a5
  • SHA1 0dca05a624d075f64efe79578a63040492815e97
  • SHA512 d7cab1ef40051f45c30b09c56c137ee0503f5d6c73106243bdcfde7bf6176d8b8ef04058c52490876127c235ffcd0f16959bb1767651641431f4d699899354bd
  • MD5 SHA1 SHA512

  Score

  10^/10

  dridex22202botnetevasionloadertrojan

  • Dridex

    Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

    botnetdridex

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Dridex Loader

    Detects Dridex both x86 and x64 loader in memory.

    botnetloader

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Loads dropped DLL

  • Checks whether UAC is enabled

    evasiontrojan
  behavioral1behavioral2