dridex | 4ed7566f8b70e42f52615a3c06512b10c6b3feef33627a82cdef1f054aa4cc75

Resubmissions

Analysis

max time kernel
149s
max time network
137s
platform
windows10_x64
resource
win10v200430
submitted
14-07-2020 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VERSION.dll
Size

972KB
MD5

07b6339df2acddd30de436999071fc4b
SHA1

2550d842be80b811afa930384c0db06908bc1011
SHA256

4ed7566f8b70e42f52615a3c06512b10c6b3feef33627a82cdef1f054aa4cc75
SHA512

ef2b54af64064f6fdd4224b3b283e9e6b76d8d92a01d6e9044d016bbf2b2b295f4ed66a48d389a08ed4fc3d72a843f7ed32f43f91280658f897b2ad078324586

Score

10^/10

dridex botnet evasion loader persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr

Dridex Loader 'dmod' strings 1 IoCs

Detects 'dmod' strings in Dridex loader.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_ldr_dmod

Executes dropped EXE 3 IoCs

Processes:

mmc.exeddodiag.exewlrmdr.exe

pid process

3696 mmc.exe
3780 ddodiag.exe
3032 wlrmdr.exe
Loads dropped DLL 3 IoCs

Processes:

mmc.exeddodiag.exewlrmdr.exe

pid process

3696 mmc.exe
3780 ddodiag.exe
3032 wlrmdr.exe

pid	process
3696	mmc.exe
3780	ddodiag.exe
3032	wlrmdr.exe

pid	process
3696	mmc.exe
3780	ddodiag.exe
3032	wlrmdr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ywfbribtuthwh = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\FtAtBSu\\ddodiag.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemmc.exeddodiag.exewlrmdr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mmc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ddodiag.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wlrmdr.exe

JavaScript code in executable 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\GSesk8\mmc.exe	js
C:\Users\Admin\AppData\Local\GSesk8\mmc.exe	js

Suspicious behavior: EnumeratesProcesses 636 IoCs

Processes:

rundll32.exe

pid	process
2016	rundll32.exe
2016	rundll32.exe
2016	rundll32.exe
2016	rundll32.exe
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012
3012

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012
Token: SeShutdownPrivilege	3012
Token: SeCreatePagefilePrivilege	3012

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3012 wrote to memory of 3532	3012	mmc.exe
PID 3012 wrote to memory of 3532	3012	mmc.exe
PID 3012 wrote to memory of 3696	3012	mmc.exe
PID 3012 wrote to memory of 3696	3012	mmc.exe
PID 3012 wrote to memory of 4036	3012	ddodiag.exe
PID 3012 wrote to memory of 4036	3012	ddodiag.exe
PID 3012 wrote to memory of 3780	3012	ddodiag.exe
PID 3012 wrote to memory of 3780	3012	ddodiag.exe
PID 3012 wrote to memory of 3612	3012	wlrmdr.exe
PID 3012 wrote to memory of 3612	3012	wlrmdr.exe
PID 3012 wrote to memory of 3032	3012	wlrmdr.exe
PID 3012 wrote to memory of 3032	3012	wlrmdr.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\VERSION.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2016

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe
1⤵
PID:3532

C:\Users\Admin\AppData\Local\GSesk8\mmc.exe
C:\Users\Admin\AppData\Local\GSesk8\mmc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3696

C:\Windows\system32\ddodiag.exe
C:\Windows\system32\ddodiag.exe
1⤵
PID:4036

C:\Users\Admin\AppData\Local\Ny5xA94\ddodiag.exe
C:\Users\Admin\AppData\Local\Ny5xA94\ddodiag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3780

C:\Windows\system32\wlrmdr.exe
C:\Windows\system32\wlrmdr.exe
1⤵
PID:3612

C:\Users\Admin\AppData\Local\2eI6D\wlrmdr.exe
C:\Users\Admin\AppData\Local\2eI6D\wlrmdr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2eI6D\DUI70.dll

MD5
29a40142458c5192858609acd4a63a55

SHA1
ae2130284a227970fda459b1119e3f3aa5fca58b

SHA256
350f5bf97e7c86043df63e9bc6f8ae0db516a347c14d8c6c683debab19b885fa

SHA512
19b34b1672f12004b18de9db64a3335ef234e1f398e331558ae3672b8c9d1aa0b1627433255679a42082ffb3a7f42fcca643a4ff7ef713671129fcccbd959093

Download Submit
C:\Users\Admin\AppData\Local\2eI6D\wlrmdr.exe

MD5
506de5c8d74692144936000b0db1071b

SHA1
8616d846c02d506319495626a9ecb67912f17855

SHA256
6b695ceb635f11d33ac0e4f1481de11eb31e03027a9a40f0a969de12b7c35458

SHA512
f286919a5e22b719016d29b15d9a6c7fe5067c470397669b2aead895e2195e7d2ed476cfccb285c48ee0c9efa181bf559012716714314c3d64946a26796f1c13

Download Submit
C:\Users\Admin\AppData\Local\GSesk8\UxTheme.dll

MD5
d287ac8eacfc403c19e339ae5ec586be

SHA1
782121b649217a21c25b66e3678a0142a93c50c7

SHA256
398d6ff6aed16ca10c40d8776bb58bf8f29223f5f6f006c9a7c0ffe52bca306c

SHA512
c4291751be1c2bd607ca22048024cb9cd23eb8719e323cbb1d7a593db723f726a217893af5ad9ae8e174529c0db1f4ad9d42f5ddece0c0a27171e0c743ac9a32

Download Submit
C:\Users\Admin\AppData\Local\GSesk8\mmc.exe

MD5
211adc0a46442c4050285c6b2c8874a1

SHA1
cf7ad4f94eda214bd5283cb8ad57db52d2d558fc

SHA256
e021d4b2f12d2836c279aeee9fe59cea300730519afa57f450ba7095b45a653f

SHA512
d4cc517a97e1bd439080eb027bddee96e0c773477885f52cde535c24281f86855ef035aa94b0dbedfbffb9da9d77e12878f165d9016b9c0465d3cd83bb0f27db

Download Submit
C:\Users\Admin\AppData\Local\GSesk8\mmc.exe

MD5
211adc0a46442c4050285c6b2c8874a1

SHA1
cf7ad4f94eda214bd5283cb8ad57db52d2d558fc

SHA256
e021d4b2f12d2836c279aeee9fe59cea300730519afa57f450ba7095b45a653f

SHA512
d4cc517a97e1bd439080eb027bddee96e0c773477885f52cde535c24281f86855ef035aa94b0dbedfbffb9da9d77e12878f165d9016b9c0465d3cd83bb0f27db

Download Submit
C:\Users\Admin\AppData\Local\Ny5xA94\XmlLite.dll

MD5
b7ff84e856840e87935f35156e4e4188

SHA1
56fc7cfd15ccfe65454075964c2739363affb29d

SHA256
920b5384de9a6893651c386e03d2ae2caf8e2db21ef55be014e4af7d00a61354

SHA512
d25951ee7ca5cb4ce4878b49a68ccfdee11b29d09067e72216ef4927bece04e0671958f679cca71ae81f60cf524b514e609257ab97c2d306693e5d3055628d88

Download Submit
C:\Users\Admin\AppData\Local\Ny5xA94\ddodiag.exe

MD5
ee569315bff1241a0dc3c7f03405459a

SHA1
93d96e68f251f47b0886301d9ee97620509379dd

SHA256
bea4eb76e40b43645905903b7ece43496f150974c17166cdcd2396d607d1e28a

SHA512
79782da92d927c2c963119fd5517bc7ea18bbc9ff70f8bd8b1e58857aef1d5cd45be0b3a1b87e00bcf05d2def63cbb71716987ee368f81a62df2cc9bca36eae0

Download Submit
\Users\Admin\AppData\Local\2eI6D\DUI70.dll

MD5
29a40142458c5192858609acd4a63a55

SHA1
ae2130284a227970fda459b1119e3f3aa5fca58b

SHA256
350f5bf97e7c86043df63e9bc6f8ae0db516a347c14d8c6c683debab19b885fa

SHA512
19b34b1672f12004b18de9db64a3335ef234e1f398e331558ae3672b8c9d1aa0b1627433255679a42082ffb3a7f42fcca643a4ff7ef713671129fcccbd959093

Download Submit
\Users\Admin\AppData\Local\GSesk8\UxTheme.dll

MD5
d287ac8eacfc403c19e339ae5ec586be

SHA1
782121b649217a21c25b66e3678a0142a93c50c7

SHA256
398d6ff6aed16ca10c40d8776bb58bf8f29223f5f6f006c9a7c0ffe52bca306c

SHA512
c4291751be1c2bd607ca22048024cb9cd23eb8719e323cbb1d7a593db723f726a217893af5ad9ae8e174529c0db1f4ad9d42f5ddece0c0a27171e0c743ac9a32

Download Submit
\Users\Admin\AppData\Local\Ny5xA94\XmlLite.dll

MD5
b7ff84e856840e87935f35156e4e4188

SHA1
56fc7cfd15ccfe65454075964c2739363affb29d

SHA256
920b5384de9a6893651c386e03d2ae2caf8e2db21ef55be014e4af7d00a61354

SHA512
d25951ee7ca5cb4ce4878b49a68ccfdee11b29d09067e72216ef4927bece04e0671958f679cca71ae81f60cf524b514e609257ab97c2d306693e5d3055628d88

Download Submit
memory/3012-2-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/3012-1-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/3012-0-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/3032-12-0x0000000000000000-mapping.dmp

Download
memory/3696-3-0x0000000000000000-mapping.dmp

Download
memory/3780-8-0x0000000000000000-mapping.dmp

Download