Overview
overview
10Static
static
Dridex/Dri...1 .exe
windows7_x64
10Dridex/Dri...1 .exe
windows10_x64
Dridex/Dri...a6.exe
windows7_x64
10Dridex/Dri...a6.exe
windows10_x64
10Dridex/Dri...01.exe
windows7_x64
10Dridex/Dri...01.exe
windows10_x64
10Dridex/Tro...a .exe
windows7_x64
10Dridex/Tro...a .exe
windows10_x64
10Dridex/Tro...27.exe
windows7_x64
10Dridex/Tro...27.exe
windows10_x64
10Dridex/Tro...c2.dll
windows7_x64
10Dridex/Tro...c2.dll
windows10_x64
10Analysis
-
max time kernel
135s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
15-04-2021 13:05
Static task
static1
Behavioral task
behavioral1
Sample
Dridex/Dridex.JhiSharp.dll.9d75ff0e9447ceb89c90cca24a1dbec1 .exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Dridex/Dridex.JhiSharp.dll.9d75ff0e9447ceb89c90cca24a1dbec1 .exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Dridex/DridexDroppedVBS.925da3a10f7dde802c8d87047b14fda6.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Dridex/DridexDroppedVBS.925da3a10f7dde802c8d87047b14fda6.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Dridex/DridexLoader.bin.exe.c26203af4b3e9c81a9e634178b603601.exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
Dridex/DridexLoader.bin.exe.c26203af4b3e9c81a9e634178b603601.exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Dridex/Trojan.Dridex.A. dbf96ab40b728c12951d317642fbd9da .exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Dridex/Trojan.Dridex.A. dbf96ab40b728c12951d317642fbd9da .exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Dridex/Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
Dridex/Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Dridex/Trojan.Dridex.A.97a26d9e3598fea2e1715c6c77b645c2.dll
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Dridex/Trojan.Dridex.A.97a26d9e3598fea2e1715c6c77b645c2.dll
Resource
win10v20210408
General
-
Target
Dridex/Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe
-
Size
152KB
-
MD5
6164228ed2cc0eceba9ce1828d87d827
-
SHA1
cea5bc473c948a78ce565b6e195e6e25f029c0c6
-
SHA256
7fa83f0588f0f50d0635313918137c05cb59aa672d842f864073aebb72c66195
-
SHA512
b53ac27397ce5453fa008d1a2e98f9f66be7d7f08375b92c88007544c09ab844d6c8eeceb2221c988e0a0d6ffc2a8a290e49715e3062a74bcd2310d41bffcc37
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral9/memory/1088-60-0x0000000002820000-0x000000000284F000-memory.dmp dridex_ldr behavioral9/memory/1752-69-0x0000000003000000-0x000000000302F000-memory.dmp dridex_ldr -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 1752 svchost.exe -
Discovers systems in the same network 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exesvchost.exepid process 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe 1752 svchost.exe 1752 svchost.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exewhoami.exedescription pid process Token: SeRestorePrivilege 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe Token: SeDebugPrivilege 1692 whoami.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exesvchost.exedescription pid process target process PID 1088 wrote to memory of 1752 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe svchost.exe PID 1088 wrote to memory of 1752 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe svchost.exe PID 1088 wrote to memory of 1752 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe svchost.exe PID 1088 wrote to memory of 1752 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe svchost.exe PID 1088 wrote to memory of 1752 1088 Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe svchost.exe PID 1752 wrote to memory of 1692 1752 svchost.exe whoami.exe PID 1752 wrote to memory of 1692 1752 svchost.exe whoami.exe PID 1752 wrote to memory of 1692 1752 svchost.exe whoami.exe PID 1752 wrote to memory of 1692 1752 svchost.exe whoami.exe PID 1752 wrote to memory of 1188 1752 svchost.exe net.exe PID 1752 wrote to memory of 1188 1752 svchost.exe net.exe PID 1752 wrote to memory of 1188 1752 svchost.exe net.exe PID 1752 wrote to memory of 1188 1752 svchost.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Dridex\Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe"C:\Users\Admin\AppData\Local\Temp\Dridex\Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe "C:\Users\Admin\AppData\Local\Temp\Dridex\Trojan.Dridex.A.6164228ed2cc0eceba9ce1828d87d827.exe"2⤵
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\whoami.exeC:\Windows\system32\whoami.exe /all3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exeC:\Windows\system32\net.exe view3⤵
- Discovers systems in the same network
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-60-0x0000000002820000-0x000000000284F000-memory.dmpFilesize
188KB
-
memory/1088-62-0x0000000075281000-0x0000000075283000-memory.dmpFilesize
8KB
-
memory/1088-64-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/1188-75-0x0000000000000000-mapping.dmp
-
memory/1692-74-0x0000000000000000-mapping.dmp
-
memory/1752-63-0x0000000000000000-mapping.dmp
-
memory/1752-65-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1752-66-0x0000000003000000-0x000000000302F000-memory.dmpFilesize
188KB
-
memory/1752-68-0x0000000003000000-0x000000000302F000-memory.dmpFilesize
188KB
-
memory/1752-67-0x0000000003000000-0x000000000302F000-memory.dmpFilesize
188KB
-
memory/1752-69-0x0000000003000000-0x000000000302F000-memory.dmpFilesize
188KB