Overview

overview

10

Static

static

2f10b593a5...62.dll

windows7_x64

10

2f10b593a5...62.dll

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2f10b593a5e04506d8050ebe39e28619199958a4f4bae0b9f3a1ee2af3d74862

  • Size

    1.2MB

  • Sample

    210928-lc3kdsbecm

  • MD5

    94f8317b419e9476120b14a29d9b05d2

  • SHA1

    f2b03dd4441f3808468bdbb8b26273cfb41b5298

  • SHA256

    2f10b593a5e04506d8050ebe39e28619199958a4f4bae0b9f3a1ee2af3d74862

  • SHA512

    73edd03df050bf72249dafdc8e0c71884d236e713b871c5e8ce9c825937ba1c8447ae791e39400a1d7b5af77aa5ec5d01b6db356003e9616ed7d24e7f78b24a3

Score
10/10
dridexbotnetevasionpayloadpersistencetrojan

Malware Config

Targets

    • Target

      2f10b593a5e04506d8050ebe39e28619199958a4f4bae0b9f3a1ee2af3d74862

    • Size

      1.2MB

    • MD5

      94f8317b419e9476120b14a29d9b05d2

    • SHA1

      f2b03dd4441f3808468bdbb8b26273cfb41b5298

    • SHA256

      2f10b593a5e04506d8050ebe39e28619199958a4f4bae0b9f3a1ee2af3d74862

    • SHA512

      73edd03df050bf72249dafdc8e0c71884d236e713b871c5e8ce9c825937ba1c8447ae791e39400a1d7b5af77aa5ec5d01b6db356003e9616ed7d24e7f78b24a3

    Score
    10/10
    dridexbotnetevasionpayloadpersistencetrojan

    • Dridex

      Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.

      botnetdridex

    • Dridex Shellcode

      Detects Dridex Payload shellcode injected in Explorer process.

      botnetpayload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks