dridex | f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d

General

Target

bd59e42a9ee00ba415448c31190e57d7.xls
Size

317KB
MD5

bd59e42a9ee00ba415448c31190e57d7
SHA1

95bc249a25513514f1859b690fdcc41f7fb78bac
SHA256

f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
SHA512

aad6ecac040ef20c61aee790155adc1937e426c3ef2240334516ed6be26c4688f764cec8cd0c051710ef35d261fc6b789d408bf6755e0714affce101603bfdca

Score

10^/10

dridex 22202 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process	780	1104	mshta.exe	EXCEL.EXE

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral1/memory/324-71-0x000000006AD80000-0x000000006ADB1000-memory.dmp	dridex_ldr

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

5 780 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 4 IoCs

Processes:

rundll32.exe

pid process

324 rundll32.exe
324 rundll32.exe
324 rundll32.exe
324 rundll32.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe
Office loads VBA resources, possible macro or embedded object present
Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

EXCEL.EXE

description ioc process

Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE

flow	pid	process
5	780	mshta.exe

pid	process
324	rundll32.exe
324	rundll32.exe
324	rundll32.exe
324	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor	EXCEL.EXE

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

Processes:

EXCEL.EXEmshta.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	EXCEL.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt	EXCEL.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	EXCEL.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1104 EXCEL.EXE
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

EXCEL.EXE

pid process

1104 EXCEL.EXE
1104 EXCEL.EXE
1104 EXCEL.EXE
1104 EXCEL.EXE
1104 EXCEL.EXE

pid	process
1104	EXCEL.EXE

pid	process
1104	EXCEL.EXE
1104	EXCEL.EXE
1104	EXCEL.EXE
1104	EXCEL.EXE
1104	EXCEL.EXE

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

EXCEL.EXEmshta.exe

description	pid	process	target process
PID 1104 wrote to memory of 780	1104	EXCEL.EXE	mshta.exe
PID 1104 wrote to memory of 780	1104	EXCEL.EXE	mshta.exe
PID 1104 wrote to memory of 780	1104	EXCEL.EXE	mshta.exe
PID 1104 wrote to memory of 780	1104	EXCEL.EXE	mshta.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe
PID 780 wrote to memory of 324	780	mshta.exe	rundll32.exe

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\bd59e42a9ee00ba415448c31190e57d7.xls
1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\ProgramData//klClipboardFormatDspText.sct
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:780
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage
    3⤵
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\klClipboardFormatDspText.sct

MD5
789795198ddaef132386abf0ec508385

SHA1
c6234646a72ec562d7e50125a77ed89d517b2cad

SHA256
aa959296837f992fec1a69463bc5c14e9a7dfcb844106208b4fba5b7a2722d47

SHA512
0fbdec930aa3f4ed791ceb4f59ff4d5e9b537fb68ebed7761d2503d99e36884e92394c3faef9da079a2c5e023af280acb0a759650cd3c533160d2d16105dfd07

Download Submit
C:\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
memory/324-65-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/324-64-0x0000000000000000-mapping.dmp

Download
memory/324-71-0x000000006AD80000-0x000000006ADB1000-memory.dmp

Filesize
196KB

Download
memory/324-73-0x00000000001A0000-0x00000000001A6000-memory.dmp

Filesize
24KB

Download
memory/780-62-0x0000000000000000-mapping.dmp

Download
memory/1104-59-0x000000002F1A1000-0x000000002F1A4000-memory.dmp

Filesize
12KB

Download
memory/1104-61-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/1104-60-0x0000000071981000-0x0000000071983000-memory.dmp

Filesize
8KB

Download
memory/1104-74-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads