dridex | c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e

Resubmissions

Analysis

max time kernel
151s
max time network
67s
platform
windows7_x64
resource
win7
submitted
14-07-2020 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XmlLite.dll
Size

972KB
MD5

a55f44aacfb66d6494db7b94f6a170e4
SHA1

f181f65e6c147b046ba6dfaffa89d7ec45ce674d
SHA256

c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e
SHA512

0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4

Score

10^/10

dridex botnet evasion loader persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1300-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/1300-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr_dmod

Executes dropped EXE 3 IoCs

Processes:

irftp.exetabcal.exeslui.exe

pid process

1048 irftp.exe
1696 tabcal.exe
1852 slui.exe
Loads dropped DLL 7 IoCs

Processes:

irftp.exetabcal.exeslui.exe

pid process

1300
1048 irftp.exe
1300
1696 tabcal.exe
1300
1852 slui.exe
1300

pid	process
1048	irftp.exe
1696	tabcal.exe
1852	slui.exe

pid	process
1300
1048	irftp.exe
1300
1696	tabcal.exe
1300
1852	slui.exe
1300

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Vpubrqhrepmzp = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\DY3X\\tabcal.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeirftp.exetabcal.exeslui.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	irftp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tabcal.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe

Suspicious behavior: EnumeratesProcesses 606 IoCs

Processes:

rundll32.exe

pid	process
112	rundll32.exe
112	rundll32.exe
112	rundll32.exe
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300
1300

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid process

1300
1300
1300
1300
1300
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

pid process

1300
1300
1300
1300
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

1300

pid	process
1300
1300
1300
1300
1300

pid	process
1300
1300
1300
1300

pid	process
1300

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1300 wrote to memory of 1652	1300	irftp.exe
PID 1300 wrote to memory of 1652	1300	irftp.exe
PID 1300 wrote to memory of 1652	1300	irftp.exe
PID 1300 wrote to memory of 1048	1300	irftp.exe
PID 1300 wrote to memory of 1048	1300	irftp.exe
PID 1300 wrote to memory of 1048	1300	irftp.exe
PID 1300 wrote to memory of 1496	1300	tabcal.exe
PID 1300 wrote to memory of 1496	1300	tabcal.exe
PID 1300 wrote to memory of 1496	1300	tabcal.exe
PID 1300 wrote to memory of 1696	1300	tabcal.exe
PID 1300 wrote to memory of 1696	1300	tabcal.exe
PID 1300 wrote to memory of 1696	1300	tabcal.exe
PID 1300 wrote to memory of 1824	1300	slui.exe
PID 1300 wrote to memory of 1824	1300	slui.exe
PID 1300 wrote to memory of 1824	1300	slui.exe
PID 1300 wrote to memory of 1852	1300	slui.exe
PID 1300 wrote to memory of 1852	1300	slui.exe
PID 1300 wrote to memory of 1852	1300	slui.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XmlLite.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:112

C:\Windows\system32\irftp.exe
C:\Windows\system32\irftp.exe
1⤵
PID:1652

C:\Users\Admin\AppData\Local\vMownU\irftp.exe
C:\Users\Admin\AppData\Local\vMownU\irftp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1048

C:\Windows\system32\tabcal.exe
C:\Windows\system32\tabcal.exe
1⤵
PID:1496

C:\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exe
C:\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1696

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:1824

C:\Users\Admin\AppData\Local\SdT2Mb9m\slui.exe
C:\Users\Admin\AppData\Local\SdT2Mb9m\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SdT2Mb9m\WINBRAND.dll

MD5
05c640b7a7666891689846bfd51ee772

SHA1
2dff37e945c6e6c372ebf8aa9243865d6b225d84

SHA256
063a51621277679148c8aac630ca3a375dd23fd8b4138b3ae29593040d512a36

SHA512
71e5917d6910b69c5e6e6e7d33d0ff9c56fc32212ae47d36a6e2f5a33cbb1fbeb1c97779617d4a9398dc3520ca7430191f548ebc7304c1f07d918d8877d78d96

Download Submit
C:\Users\Admin\AppData\Local\SdT2Mb9m\slui.exe

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
C:\Users\Admin\AppData\Local\iSjFuuvzf\HID.DLL

MD5
fc6375d824a89447d41c5e3de640d817

SHA1
8478c2a3cc290aea7ebc1990c11adf5ea1de2c92

SHA256
0a0ef1a0811d76b56416054f317be266a6fee0f0cdd3d91bb1dd8d184afbe7fb

SHA512
7484d3e2c6d7288b12a1e313a53bc4234cee9aa54e44b9173ab6dbbf93b59ab07c7dee36769d6f0046fd7823be9531d3b4e7db69e029f2e7bd5ae5a51c6ca33f

Download Submit
C:\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exe

MD5
98e7911befe83f76777317ce6905666d

SHA1
2780088dffe1dd1356c5dd5112a9f04afee3ee8d

SHA256
3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1

SHA512
fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

Download Submit
C:\Users\Admin\AppData\Local\vMownU\WTSAPI32.dll

MD5
e1e01f416a7ab31d134e985a5f4f0006

SHA1
1ad485eeeed84b093842ddb7c9a55cff3f4868d9

SHA256
e3a67b6c96181af20a7d6fdfed80b48619a368e6b25f7a721ff60082799a2175

SHA512
742a206a631f2de4434b9b93a7f608c060d81f1a8b26659e128681f6544ac69fc47f397f69295bbcd55c8a5f258f993db798f55ddd129b1ad40f6d28cf5f170a

Download Submit
C:\Users\Admin\AppData\Local\vMownU\irftp.exe

MD5
0cae1fb725c56d260bfd6feba7ae9a75

SHA1
102ac676a1de3ec3d56401f8efd518c31c8b0b80

SHA256
312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

SHA512
db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

Download Submit
\Users\Admin\AppData\Local\SdT2Mb9m\WINBRAND.dll

MD5
05c640b7a7666891689846bfd51ee772

SHA1
2dff37e945c6e6c372ebf8aa9243865d6b225d84

SHA256
063a51621277679148c8aac630ca3a375dd23fd8b4138b3ae29593040d512a36

SHA512
71e5917d6910b69c5e6e6e7d33d0ff9c56fc32212ae47d36a6e2f5a33cbb1fbeb1c97779617d4a9398dc3520ca7430191f548ebc7304c1f07d918d8877d78d96

Download Submit
\Users\Admin\AppData\Local\SdT2Mb9m\slui.exe

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
\Users\Admin\AppData\Local\iSjFuuvzf\HID.DLL

MD5
fc6375d824a89447d41c5e3de640d817

SHA1
8478c2a3cc290aea7ebc1990c11adf5ea1de2c92

SHA256
0a0ef1a0811d76b56416054f317be266a6fee0f0cdd3d91bb1dd8d184afbe7fb

SHA512
7484d3e2c6d7288b12a1e313a53bc4234cee9aa54e44b9173ab6dbbf93b59ab07c7dee36769d6f0046fd7823be9531d3b4e7db69e029f2e7bd5ae5a51c6ca33f

Download Submit
\Users\Admin\AppData\Local\iSjFuuvzf\tabcal.exe

MD5
98e7911befe83f76777317ce6905666d

SHA1
2780088dffe1dd1356c5dd5112a9f04afee3ee8d

SHA256
3fe8b63367b4298e70d46e87ce04cc7af5f30dfdb86b79eae41d0731d9415ea1

SHA512
fc0226381d9a6984cccac8282697c78966524e1359f7f6044559b8223e773d3c108dda08a2dd283aa171dca3390801f2c92a5d1dbb978dd7f92a67bd8877b8b6

Download Submit
\Users\Admin\AppData\Local\vMownU\WTSAPI32.dll

MD5
e1e01f416a7ab31d134e985a5f4f0006

SHA1
1ad485eeeed84b093842ddb7c9a55cff3f4868d9

SHA256
e3a67b6c96181af20a7d6fdfed80b48619a368e6b25f7a721ff60082799a2175

SHA512
742a206a631f2de4434b9b93a7f608c060d81f1a8b26659e128681f6544ac69fc47f397f69295bbcd55c8a5f258f993db798f55ddd129b1ad40f6d28cf5f170a

Download Submit
\Users\Admin\AppData\Local\vMownU\irftp.exe

MD5
0cae1fb725c56d260bfd6feba7ae9a75

SHA1
102ac676a1de3ec3d56401f8efd518c31c8b0b80

SHA256
312f4107ff37dc988d99c5f56178708bb74a3906740cff4e337c0dde8f1e151d

SHA512
db969064577c4158d6bf925354319766b0d0373ddefb03dbfc9a9d2cadf8ddcd50a7f99b7ddf2ffad5e7fdbb6f02090b5b678bdf792d265054bff3b56ee0b8ec

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\d7zk\slui.exe

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
memory/1048-4-0x0000000000000000-mapping.dmp

Download
memory/1300-0-0x0000000006220000-0x0000000006221000-memory.dmp

Filesize
4KB

Download
memory/1300-2-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/1300-1-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/1696-9-0x0000000000000000-mapping.dmp

Download
memory/1852-14-0x0000000000000000-mapping.dmp

Download