dridex | 765a0b4da72ab6434010d966df81d1853a6dcb1327b609319332390856c4ac73

General

Target

765a0b4da72ab6434010d966df81d1853a6dcb1327b609319332390856c4ac73 (1).xls
Size

60KB
MD5

43f414109ce2d6499a026495da965d4c
SHA1

2e758022671b7e8b2b34d1e0f4b8084a1e824eed
SHA256

765a0b4da72ab6434010d966df81d1853a6dcb1327b609319332390856c4ac73
SHA512

44a554e048308dcb481164bee66e16ce4042b1af9818a48d97b18ff0bf27b49db1a4f21a22054e56f494e70b7bcca6b212f3a96c80398125cea5fd8c1b463a48

Score

10^/10

dridex 10444 botnet loader

Malware Config

Extracted

Language

xlm4.0

Source

Extracted

Family

dridex

Botnet

10444

C2

146.185.170.249:443

62.75.251.60:6601

185.148.168.25:2303

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

regsvr32.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	664	1820	regsvr32.exe	EXCEL.EXE

Dridex Loader 2 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/664-68-0x000000006BCE0000-0x000000006BDF6000-memory.dmp	dridex_ldr
behavioral1/memory/664-67-0x000000006BCE0000-0x000000006BD1D000-memory.dmp	dridex_ldr

Loads dropped DLL 1 IoCs

Processes:

regsvr32.exe

pid process

664 regsvr32.exe
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

pid	process
664	regsvr32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1820 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

1820 EXCEL.EXE
1820 EXCEL.EXE
1820 EXCEL.EXE
1820 EXCEL.EXE
1820 EXCEL.EXE

pid	process
1820	EXCEL.EXE

pid	process
1820	EXCEL.EXE
1820	EXCEL.EXE
1820	EXCEL.EXE
1820	EXCEL.EXE
1820	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

EXCEL.EXE

description	pid	process	target process
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe
PID 1820 wrote to memory of 664	1820	EXCEL.EXE	regsvr32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\765a0b4da72ab6434010d966df81d1853a6dcb1327b609319332390856c4ac73 (1).xls"
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" -s C:\Users\Admin\AppData\Local\Temp\ukoiv.dll
2⤵
- Process spawned unexpected child process
- Loads dropped DLL
PID:664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
e14d3431e6ca8011097e2d70039706a9

SHA1
4e2aa123b3a4d6e3388bf81ff083c8685b3e8f4e

SHA256
df5dc7d999812a6bf2e27fe5637eb15e84db00c31d7cb8679a5e9aa6d3bf1db9

SHA512
156a47d3f37930a4b6a584be9d92e216a6300b383a476b6f7a91a6d3875076a6de6817e9aa92f6e0b89911a64b1de6bb1c3fd9d28f3fb344a3c6bba82145f90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ukoiv.dll
MD5
340994098deb6bf6fa91f73350af7c15

SHA1
a13e3401f4a3741bdcb2f16cb0c111b04ce318fb

SHA256
da81aa0dd37baccdbdc7f7f9a3619d6e85155f8bd67fcd2fafdbe534443fdc0c

SHA512
3ce706f04dbe866ac020648bc58a5940b06dfc8d23e87ea570d2af0037b6bd320976f87168ec327d9a442c3762c9e7414cbf026b89b736bb42e2d20e269ad30d

Download Submit
\Users\Admin\AppData\Local\Temp\ukoiv.dll
MD5
340994098deb6bf6fa91f73350af7c15

SHA1
a13e3401f4a3741bdcb2f16cb0c111b04ce318fb

SHA256
da81aa0dd37baccdbdc7f7f9a3619d6e85155f8bd67fcd2fafdbe534443fdc0c

SHA512
3ce706f04dbe866ac020648bc58a5940b06dfc8d23e87ea570d2af0037b6bd320976f87168ec327d9a442c3762c9e7414cbf026b89b736bb42e2d20e269ad30d

Download Submit
memory/664-63-0x0000000000000000-mapping.dmp

Download
memory/664-64-0x0000000076641000-0x0000000076643000-memory.dmp

Filesize
8KB

Download
memory/664-68-0x000000006BCE0000-0x000000006BDF6000-memory.dmp

Filesize
1.1MB

Download
memory/664-67-0x000000006BCE0000-0x000000006BD1D000-memory.dmp

Filesize
244KB

Download
memory/664-69-0x0000000000190000-0x0000000000191000-memory.dmp

Filesize
4KB

Download
memory/1820-60-0x000000002F851000-0x000000002F854000-memory.dmp

Filesize
12KB

Download
memory/1820-61-0x00000000716D1000-0x00000000716D3000-memory.dmp

Filesize
8KB

Download
memory/1820-62-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads