dridex | f3b8f148365e3e24d29954ef8541d32bdf7da1f0bc644adf3a9bd702bb2b8e5f

General

Target

Invoice_238880.xlsm
Size

332KB
MD5

814593d39bfff7912ad3b235d72880f1
SHA1

e22a41f3e27deb098f2b6663c174cf1ff2d8becc
SHA256

f3b8f148365e3e24d29954ef8541d32bdf7da1f0bc644adf3a9bd702bb2b8e5f
SHA512

d7fde5c8292b5cc2f0443c6ec593ec9c4a3a073d1c3f6c6a308471340e2247ae56ac269737474ca805244030d95bc55a898bb84771c07367e1411ae2dfded642

Score

10^/10

dridex 22201 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.79.33.48:443

139.162.202.74:5007

68.183.216.174:7443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3168	3968	mshta.exe	EXCEL.EXE

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/4144-279-0x00000000755E0000-0x0000000075610000-memory.dmp	dridex_ldr

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

23 3168 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4144 rundll32.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe

flow	pid	process
23	3168	mshta.exe

pid	process
4144	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3968 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE
3968	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

EXCEL.EXEmshta.exerundll32.exe

description	pid	process	target process
PID 3968 wrote to memory of 3168	3968	EXCEL.EXE	mshta.exe
PID 3968 wrote to memory of 3168	3968	EXCEL.EXE	mshta.exe
PID 3168 wrote to memory of 4120	3168	mshta.exe	rundll32.exe
PID 3168 wrote to memory of 4120	3168	mshta.exe	rundll32.exe
PID 4120 wrote to memory of 4144	4120	rundll32.exe	rundll32.exe
PID 4120 wrote to memory of 4144	4120	rundll32.exe	rundll32.exe
PID 4120 wrote to memory of 4144	4120	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Invoice_238880.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3968

C:\Windows\SYSTEM32\mshta.exe
mshta C:\ProgramData//theLowerCaseColumnLetter.sct
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe C:\ProgramData\qKatakanaHalf.dll,AddLookaside
3⤵
- Suspicious use of WriteProcessMemory
PID:4120

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\ProgramData\qKatakanaHalf.dll,AddLookaside
4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4144

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\qKatakanaHalf.dll
MD5
ebdfd39f4b9ab189cd32b271db4bb3ac

SHA1
839ca7bf434c05541e2df56e1eab0819a5822b1d

SHA256
0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53

SHA512
f050cf3506ba11bb06710590e050c7e18a50815d5401d065fa4c3732afae718a509dbe3cc2a14fa040f7555414f2a183eba841e63d4df8112f00fcc78842afbe

Download Submit
C:\ProgramData\theLowerCaseColumnLetter.sct
MD5
211328ccfdf739bb99c84b0e05b8c671

SHA1
bed9c7ab07c7d898c898f467ea0d473253bec68c

SHA256
ac1e1e446879047d2c187ef007d3b53cf09123517611168e3b1c7519d0033896

SHA512
007c836043d7b981b39345946398bbbaa7c6f7e42ab842003806a58ae11c3fa7c9d677633866eee680aefd7ce3edb9a9d8e001407dc08dfb513b8c73ccd1537d

Download Submit
\ProgramData\qKatakanaHalf.dll
MD5
ebdfd39f4b9ab189cd32b271db4bb3ac

SHA1
839ca7bf434c05541e2df56e1eab0819a5822b1d

SHA256
0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53

SHA512
f050cf3506ba11bb06710590e050c7e18a50815d5401d065fa4c3732afae718a509dbe3cc2a14fa040f7555414f2a183eba841e63d4df8112f00fcc78842afbe

Download Submit
memory/3168-265-0x0000000000000000-mapping.dmp

Download
memory/3968-118-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-121-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-122-0x00007FFDC2F70000-0x00007FFDC405E000-memory.dmp

Filesize
16.9MB

Download
memory/3968-123-0x00007FFDC1070000-0x00007FFDC2F65000-memory.dmp

Filesize
31.0MB

Download
memory/3968-75574-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-117-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-114-0x00007FF78F0F0000-0x00007FF7926A6000-memory.dmp

Filesize
53.7MB

Download
memory/3968-116-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-75580-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-115-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-75576-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/3968-75578-0x00007FFDA2790000-0x00007FFDA27A0000-memory.dmp

Filesize
64KB

Download
memory/4120-275-0x0000000000000000-mapping.dmp

Download
memory/4144-281-0x0000000000930000-0x0000000000A7A000-memory.dmp

Filesize
1.3MB

Download
memory/4144-279-0x00000000755E0000-0x0000000075610000-memory.dmp

Filesize
192KB

Download
memory/4144-277-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads