dridex | fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d

Analysis

max time kernel
52s
max time network
152s
platform
windows10_x64
resource
win10
submitted
24/09/2020, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Report-24Sept.2020.scr
Size 734KB
Sample200924-7yc6h3trfa
SHA256 fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
MD5 d594e8a2098a81c9bfa24f3c17c992e6
SHA1 b9c820973407c7b4bef5b9ce98b7af62cafa397d
SHA512 50049d1ded3f8cfcb6aa839c0341e91bb39b46dbd5376533f2725ce27e6ae5059d3f5af71100dd025b03b7a3cf90bfa920a93818ac1bafb30c65460514c4fd47
MD5 SHA1 SHA512

Score

10^/10

dridex 10555 botnet evasion loader ransomware

Malware Config

Extracted

Family

dridex

Botnet

10555

151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

resource	yara_rule
behavioral2/memory/2192-19-0x0000000073120000-0x000000007315D000-memory.dmp	dridex_ldr

Executes dropped EXE 1 IoCs

pid	Process
1876	PLS.exe

Sets file to hidden 1 TTPs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1158

Loads dropped DLL 1 IoCs

pid	Process
2192	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
ransomware

System Information Discovery
T1082

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
2068	timeout.exe
2856	timeout.exe
3168	timeout.exe
1060	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	Report-24Sept.2020.scr
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 200	3588	Report-24Sept.2020.scr	73
PID 3588 wrote to memory of 200	3588	Report-24Sept.2020.scr	73
PID 3588 wrote to memory of 200	3588	Report-24Sept.2020.scr	73
PID 200 wrote to memory of 804	200	WScript.exe	74
PID 200 wrote to memory of 804	200	WScript.exe	74
PID 200 wrote to memory of 804	200	WScript.exe	74
PID 804 wrote to memory of 1060	804	cmd.exe	76
PID 804 wrote to memory of 1060	804	cmd.exe	76
PID 804 wrote to memory of 1060	804	cmd.exe	76
PID 804 wrote to memory of 1876	804	cmd.exe	79
PID 804 wrote to memory of 1876	804	cmd.exe	79
PID 804 wrote to memory of 1876	804	cmd.exe	79
PID 804 wrote to memory of 2068	804	cmd.exe	80
PID 804 wrote to memory of 2068	804	cmd.exe	80
PID 804 wrote to memory of 2068	804	cmd.exe	80
PID 804 wrote to memory of 2780	804	cmd.exe	82
PID 804 wrote to memory of 2780	804	cmd.exe	82
PID 804 wrote to memory of 2780	804	cmd.exe	82
PID 804 wrote to memory of 2856	804	cmd.exe	83
PID 804 wrote to memory of 2856	804	cmd.exe	83
PID 804 wrote to memory of 2856	804	cmd.exe	83
PID 2780 wrote to memory of 3232	2780	WScript.exe	84
PID 2780 wrote to memory of 3232	2780	WScript.exe	84
PID 2780 wrote to memory of 3232	2780	WScript.exe	84
PID 3232 wrote to memory of 3556	3232	cmd.exe	86
PID 3232 wrote to memory of 3556	3232	cmd.exe	86
PID 3232 wrote to memory of 3556	3232	cmd.exe	86
PID 3232 wrote to memory of 3168	3232	cmd.exe	87
PID 3232 wrote to memory of 3168	3232	cmd.exe	87
PID 3232 wrote to memory of 3168	3232	cmd.exe	87
PID 3232 wrote to memory of 2192	3232	cmd.exe	88
PID 3232 wrote to memory of 2192	3232	cmd.exe	88
PID 3232 wrote to memory of 2192	3232	cmd.exe	88

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

pid	Process
3556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Report-24Sept.2020.scr
"C:\Users\Admin\AppData\Local\Temp\Report-24Sept.2020.scr" /S
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\XIU\configurate\selector.vbs" /f=CREATE_NO_WINDOW install.cmd
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:200
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\XIU\configurate\dsep.bat" "
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:804
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:1060
  - - C:\XIU\configurate\PLS.exe
      "PLS.exe" e -pVersion hl.rar
      4⤵
      Executes dropped EXE
      PID:1876
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:2068
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\XIU\configurate\fatless.vbs"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\XIU\configurate\lll.bat" "
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3232
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\XIU"
        6⤵
        Views/modifies file attributes
        
        PID:3556
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        6⤵
        Delays execution with timeout.exe
        
        PID:3168
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 -s CONFIG.dll
        6⤵
        Loads dropped DLL
        
        PID:2192
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      Delays execution with timeout.exe
      PID:2856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2192-19-0x0000000073120000-0x000000007315D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads