dridex | c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e

Resubmissions

Analysis

max time kernel
149s
max time network
146s
platform
windows10_x64
resource
win10v200430
submitted
14-07-2020 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

XmlLite.dll
Size

972KB
MD5

a55f44aacfb66d6494db7b94f6a170e4
SHA1

f181f65e6c147b046ba6dfaffa89d7ec45ce674d
SHA256

c08e237f028ef67db6139e16aa4084c8cbada6ce15406819110bb22db01b406e
SHA512

0133d75cbffb9ed1127f70c86dfef7544a5e2d731d0f60030e1578e73025aa155415e23d32f0755c421059056f9030de2af8240b338008c7fcccc6c28ecaa3d4

Score

10^/10

dridex botnet evasion loader persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr_dmod

Executes dropped EXE 3 IoCs

Processes:

irftp.exewusa.exeBitLockerWizard.exe

pid process

2192 irftp.exe
2592 wusa.exe
2900 BitLockerWizard.exe
Loads dropped DLL 3 IoCs

Processes:

irftp.exewusa.exeBitLockerWizard.exe

pid process

2192 irftp.exe
2592 wusa.exe
2900 BitLockerWizard.exe

pid	process
2192	irftp.exe
2592	wusa.exe
2900	BitLockerWizard.exe

pid	process
2192	irftp.exe
2592	wusa.exe
2900	BitLockerWizard.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\ho1wcjySrO\\wusa.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

BitLockerWizard.exerundll32.exeirftp.exewusa.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BitLockerWizard.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	irftp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wusa.exe

Modifies registry class 2 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance

Suspicious behavior: EnumeratesProcesses 624 IoCs

Processes:

rundll32.exe

pid	process
2536	rundll32.exe
2536	rundll32.exe
2536	rundll32.exe
2536	rundll32.exe
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pid process

3012
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pid process

3012

pid	process
3012

pid	process
3012

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3012 wrote to memory of 2176	3012	irftp.exe
PID 3012 wrote to memory of 2176	3012	irftp.exe
PID 3012 wrote to memory of 2192	3012	irftp.exe
PID 3012 wrote to memory of 2192	3012	irftp.exe
PID 3012 wrote to memory of 2492	3012	wusa.exe
PID 3012 wrote to memory of 2492	3012	wusa.exe
PID 3012 wrote to memory of 2592	3012	wusa.exe
PID 3012 wrote to memory of 2592	3012	wusa.exe
PID 3012 wrote to memory of 2880	3012	BitLockerWizard.exe
PID 3012 wrote to memory of 2880	3012	BitLockerWizard.exe
PID 3012 wrote to memory of 2900	3012	BitLockerWizard.exe
PID 3012 wrote to memory of 2900	3012	BitLockerWizard.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\XmlLite.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2536

C:\Windows\system32\irftp.exe
C:\Windows\system32\irftp.exe
1⤵
PID:2176

C:\Users\Admin\AppData\Local\DgPNn0\irftp.exe
C:\Users\Admin\AppData\Local\DgPNn0\irftp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192

C:\Windows\system32\wusa.exe
C:\Windows\system32\wusa.exe
1⤵
PID:2492

C:\Users\Admin\AppData\Local\hCDPK5f\wusa.exe
C:\Users\Admin\AppData\Local\hCDPK5f\wusa.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2592

C:\Windows\system32\BitLockerWizard.exe
C:\Windows\system32\BitLockerWizard.exe
1⤵
PID:2880

C:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exe
C:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DgPNn0\WINMM.dll

MD5
f87bea2be4b4d8fd46917e39a6793440

SHA1
6ca9b0aabae865a97ff0638fd79fd2abfe967b99

SHA256
1529356aef83f46b1e93e551edcc7d65d8e1e74e0f4d22b210e915f2e8bffc3a

SHA512
9e2f71bcf862a96ffce42663eb38a656aa4d0f79cfe70e6cef43cd4a4b1795529517195f423c03455830ab8a9ea3f1efa906321c4f2c43337a8e086c13ddc2c9

Download Submit
C:\Users\Admin\AppData\Local\DgPNn0\irftp.exe

MD5
dbc1bc119e305f66dabe98d43e40113a

SHA1
76cc827689d52f2aeb3acc679e6b1a69f7674052

SHA256
cb2bf82f7d678a376a9609048518b1bcc40c41a0d689248753cbd7a7f3744468

SHA512
1bdb81ee7c2505a94d224390c0ae84262986f11b4d86acc0259a483f7a264aaebf2744068504c4200b98922f713ef3f0f3e1dbb8aed50f9fb625dc458585b415

Download Submit
C:\Users\Admin\AppData\Local\hCDPK5f\dpx.dll

MD5
cb4b3823ffd9acbae99f816e868a6497

SHA1
e21d7faf3fdfb5793e05d84621839b7fb09e3c2b

SHA256
6052eaa663cee42fcd251888754da18545ac06388e73d22a56472213ae49e443

SHA512
44a779ad39c748a26242814b8888c3b897b2225d3218f7513e86e984755a191f8600402576e5e26d6f0d3a7f5b5186aa04fd9aebd27cf8c26d67687fa8e08c9e

Download Submit
C:\Users\Admin\AppData\Local\hCDPK5f\wusa.exe

MD5
808ee0ed0ebebe64832bf7fbe034d23a

SHA1
30d23c3e8f4705d2e720deecfc7544d78a2857a5

SHA256
44a7409999c9b75e6473c8f4395a1335fd65e002bcfea94cf8af2734c0993f9e

SHA512
8356ac02e92407e5061db4e5945c870f8f69839d208e504e739c28b87bea7c049fdd3dbc9dd62b659d1caee82a028776ae0824182f8329010cf9e521259a8e4c

Download Submit
C:\Users\Admin\AppData\Local\riVyW7cZO\BitLockerWizard.exe

MD5
c213e950a565d1fbe302961f029dddc8

SHA1
edeaf01a3dbfdfca54a5e25c121d9645dd75bf86

SHA256
f90e755a99ce576c643b751d4f87f4b301d0bf7264f74023225b9b8b7f2e302d

SHA512
081f5ee07b6ffae41e494a13c720a8fb92a05c68b1f72c0bc6422050fabc2a433b84f6a3991defa4bfc9d5a721fb8cd83927613d4423f918cf8e57427e825fb0

Download Submit
C:\Users\Admin\AppData\Local\riVyW7cZO\FVEWIZ.dll

MD5
76a4d9d0ec9a27d3799a4744ae5de374

SHA1
aac25064911f27c3c26b018cd70dbd8e69c52e61

SHA256
0efaa23b460712e3a3432e6255712ad8c3c34a337b0a84f41e38984b427bf10d

SHA512
36c64ab19159f77bf2604b561cd67faf65973a2c98fbe0a8ccfa8658ed0162da943552b3274a48b88ade3811c20187b9a53e6abaa448d0e7d458c42cf817efc9

Download Submit
\Users\Admin\AppData\Local\DgPNn0\WINMM.dll

MD5
f87bea2be4b4d8fd46917e39a6793440

SHA1
6ca9b0aabae865a97ff0638fd79fd2abfe967b99

SHA256
1529356aef83f46b1e93e551edcc7d65d8e1e74e0f4d22b210e915f2e8bffc3a

SHA512
9e2f71bcf862a96ffce42663eb38a656aa4d0f79cfe70e6cef43cd4a4b1795529517195f423c03455830ab8a9ea3f1efa906321c4f2c43337a8e086c13ddc2c9

Download Submit
\Users\Admin\AppData\Local\hCDPK5f\dpx.dll

MD5
cb4b3823ffd9acbae99f816e868a6497

SHA1
e21d7faf3fdfb5793e05d84621839b7fb09e3c2b

SHA256
6052eaa663cee42fcd251888754da18545ac06388e73d22a56472213ae49e443

SHA512
44a779ad39c748a26242814b8888c3b897b2225d3218f7513e86e984755a191f8600402576e5e26d6f0d3a7f5b5186aa04fd9aebd27cf8c26d67687fa8e08c9e

Download Submit
\Users\Admin\AppData\Local\riVyW7cZO\FVEWIZ.dll

MD5
76a4d9d0ec9a27d3799a4744ae5de374

SHA1
aac25064911f27c3c26b018cd70dbd8e69c52e61

SHA256
0efaa23b460712e3a3432e6255712ad8c3c34a337b0a84f41e38984b427bf10d

SHA512
36c64ab19159f77bf2604b561cd67faf65973a2c98fbe0a8ccfa8658ed0162da943552b3274a48b88ade3811c20187b9a53e6abaa448d0e7d458c42cf817efc9

Download Submit
memory/2192-3-0x0000000000000000-mapping.dmp

Download
memory/2592-7-0x0000000000000000-mapping.dmp

Download
memory/2900-11-0x0000000000000000-mapping.dmp

Download
memory/3012-0-0x0000000000500000-0x0000000000501000-memory.dmp

Filesize
4KB

Download
memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/3012-1-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download