dridex | f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d

General

Target

bd59e42a9ee00ba415448c31190e57d7.xls
Size

317KB
MD5

bd59e42a9ee00ba415448c31190e57d7
SHA1

95bc249a25513514f1859b690fdcc41f7fb78bac
SHA256

f4f0127923c4a1c69aab04516907fd4010f9af8302e132b972d053813577b18d
SHA512

aad6ecac040ef20c61aee790155adc1937e426c3ef2240334516ed6be26c4688f764cec8cd0c051710ef35d261fc6b789d408bf6755e0714affce101603bfdca

Score

10^/10

dridex 22202 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

22202

C2

178.238.236.59:443

104.245.52.73:5007

81.0.236.93:13786

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	2660	1832	mshta.exe	EXCEL.EXE

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3832-277-0x00000000743F0000-0x0000000074421000-memory.dmp	dridex_ldr

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

28 2660 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3832 rundll32.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe

flow	pid	process
28	2660	mshta.exe

pid	process
3832	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

1832 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE
1832	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

EXCEL.EXEmshta.exerundll32.exe

description	pid	process	target process
PID 1832 wrote to memory of 2660	1832	EXCEL.EXE	mshta.exe
PID 1832 wrote to memory of 2660	1832	EXCEL.EXE	mshta.exe
PID 2660 wrote to memory of 1492	2660	mshta.exe	rundll32.exe
PID 2660 wrote to memory of 1492	2660	mshta.exe	rundll32.exe
PID 1492 wrote to memory of 3832	1492	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 3832	1492	rundll32.exe	rundll32.exe
PID 1492 wrote to memory of 3832	1492	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\bd59e42a9ee00ba415448c31190e57d7.xls"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SYSTEM32\mshta.exe
  mshta C:\ProgramData//klClipboardFormatDspText.sct
  2⤵
  - Process spawned unexpected child process
  - Blocklisted process makes network request
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\SYSTEM32\rundll32.exe
    rundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe C:\ProgramData\qDialogFormatText.dll,SetRealTimeUsage
      4⤵
      Loads dropped DLL
      Checks whether UAC is enabled
      PID:3832

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\klClipboardFormatDspText.sct

MD5
789795198ddaef132386abf0ec508385

SHA1
c6234646a72ec562d7e50125a77ed89d517b2cad

SHA256
aa959296837f992fec1a69463bc5c14e9a7dfcb844106208b4fba5b7a2722d47

SHA512
0fbdec930aa3f4ed791ceb4f59ff4d5e9b537fb68ebed7761d2503d99e36884e92394c3faef9da079a2c5e023af280acb0a759650cd3c533160d2d16105dfd07

Download Submit
C:\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
\ProgramData\qDialogFormatText.dll

MD5
aae1e725e2dbfd91213be22e857f9d02

SHA1
7a2c52b1185e6024787eadaf18bd7f7ccfaa0f14

SHA256
3cba24dba02d5817a029caee6eadf1b3b4eb75ff861c62df3e4d4fbde1c349c2

SHA512
6f63202d5f64789b92a1a43ad497eb38941bd7aa9ab466500b3d6504266da8c71265d3d476a9a4a682c074c883b2c0d2c44ad2da1e4ce65bb1a9f37cda7bc930

Download Submit
memory/1492-273-0x0000000000000000-mapping.dmp

Download
memory/1832-121-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-57917-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-122-0x00007FFDF7900000-0x00007FFDF89EE000-memory.dmp

Filesize
16.9MB

Download
memory/1832-123-0x00000173F4410000-0x00000173F6305000-memory.dmp

Filesize
31.0MB

Download
memory/1832-114-0x00007FF7EB2A0000-0x00007FF7EE856000-memory.dmp

Filesize
53.7MB

Download
memory/1832-118-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-117-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-116-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-57922-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-115-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-57921-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/1832-57919-0x00007FFDD78A0000-0x00007FFDD78B0000-memory.dmp

Filesize
64KB

Download
memory/2660-264-0x0000000000000000-mapping.dmp

Download
memory/3832-279-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/3832-277-0x00000000743F0000-0x0000000074421000-memory.dmp

Filesize
196KB

Download
memory/3832-275-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads