dridex | 9384bb6127c78785cdb717a01f7d8efcb9c8b401a0aec4d943b3214c1032fac7

General

Target

9384bb6127c78785cdb717a01f7d8efcb9c8b401a0aec4d943b3214c1032fac7.xlsm
Size

328KB
MD5

5049c8efe625f614b1548ddae83fc621
SHA1

58f791beff16d82d9ec1f65ddb327ff297c7759d
SHA256

9384bb6127c78785cdb717a01f7d8efcb9c8b401a0aec4d943b3214c1032fac7
SHA512

b11a347d28a6402404833f98936ac85d6cab8b4c8e09154b525d6bde57f66148172f5f411eff5791fc20e8d97293ed28a78729f153493f9b900c4d50bf00564c

Score

10^/10

dridex 22201 botnet evasion loader trojan

Malware Config

Extracted

Family

dridex

Botnet

22201

C2

45.79.33.48:443

139.162.202.74:5007

68.183.216.174:7443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

Processes:

mshta.exe

description	pid	pid_target	process	target process
Parent C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE is not expected to spawn this process	3648	3920	mshta.exe	EXCEL.EXE

Dridex Loader 1 IoCs

Detects Dridex both x86 and x64 loader in memory.

botnet loader

Processes:

resource	yara_rule
behavioral2/memory/3012-276-0x0000000073560000-0x0000000073590000-memory.dmp	dridex_ldr

Blocklisted process makes network request 1 IoCs

Processes:

mshta.exe

flow pid process

25 3648 mshta.exe
Downloads MZ/PE file
Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

3012 rundll32.exe
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

rundll32.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe

flow	pid	process
25	3648	mshta.exe

pid	process
3012	rundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

EXCEL.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

EXCEL.EXE

pid process

3920 EXCEL.EXE
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

EXCEL.EXE

pid process

3920 EXCEL.EXE
3920 EXCEL.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

EXCEL.EXE

pid	process
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE
3920	EXCEL.EXE

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

EXCEL.EXEmshta.exerundll32.exe

description	pid	process	target process
PID 3920 wrote to memory of 3648	3920	EXCEL.EXE	mshta.exe
PID 3920 wrote to memory of 3648	3920	EXCEL.EXE	mshta.exe
PID 3648 wrote to memory of 2504	3648	mshta.exe	rundll32.exe
PID 3648 wrote to memory of 2504	3648	mshta.exe	rundll32.exe
PID 2504 wrote to memory of 3012	2504	rundll32.exe	rundll32.exe
PID 2504 wrote to memory of 3012	2504	rundll32.exe	rundll32.exe
PID 2504 wrote to memory of 3012	2504	rundll32.exe	rundll32.exe

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9384bb6127c78785cdb717a01f7d8efcb9c8b401a0aec4d943b3214c1032fac7.xlsm"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3920

C:\Windows\SYSTEM32\mshta.exe
mshta C:\ProgramData//theListDataTypeDateTime.sct
2⤵
- Process spawned unexpected child process
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3648

C:\Windows\SYSTEM32\rundll32.exe
rundll32.exe C:\ProgramData\qPublishers.dll,AddLookaside
3⤵
- Suspicious use of WriteProcessMemory
PID:2504

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\ProgramData\qPublishers.dll,AddLookaside
4⤵
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3012

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

3

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\qPublishers.dll
MD5
ebdfd39f4b9ab189cd32b271db4bb3ac

SHA1
839ca7bf434c05541e2df56e1eab0819a5822b1d

SHA256
0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53

SHA512
f050cf3506ba11bb06710590e050c7e18a50815d5401d065fa4c3732afae718a509dbe3cc2a14fa040f7555414f2a183eba841e63d4df8112f00fcc78842afbe

Download Submit
C:\ProgramData\theListDataTypeDateTime.sct
MD5
e33708c84c76743f9d601956537e3466

SHA1
9c5c43a7d21b0ce4390aaf9c90a1091e95d8dfab

SHA256
ae9b0957dba2915d5c83744e397746be4f6e0e374ceff96a5d6e5b71e5f8b0d9

SHA512
24ae058bbd2360a81c41787a5e0453710dd5975c04728715f21e724911d9ca2c651659e006771beb57a0991f97993a7805ddaba45a925eb87bce7eca59d68904

Download Submit
\ProgramData\qPublishers.dll
MD5
ebdfd39f4b9ab189cd32b271db4bb3ac

SHA1
839ca7bf434c05541e2df56e1eab0819a5822b1d

SHA256
0f52e85eae79fb03bd9b391bc9753417cd066990a41251d385f55e2c9c7b4b53

SHA512
f050cf3506ba11bb06710590e050c7e18a50815d5401d065fa4c3732afae718a509dbe3cc2a14fa040f7555414f2a183eba841e63d4df8112f00fcc78842afbe

Download Submit
memory/2504-272-0x0000000000000000-mapping.dmp

Download
memory/3012-278-0x0000000000BE0000-0x0000000000D2A000-memory.dmp

Filesize
1.3MB

Download
memory/3012-276-0x0000000073560000-0x0000000073590000-memory.dmp

Filesize
192KB

Download
memory/3012-274-0x0000000000000000-mapping.dmp

Download
memory/3648-261-0x0000000000000000-mapping.dmp

Download
memory/3920-114-0x00007FF614540000-0x00007FF617AF6000-memory.dmp

Filesize
53.7MB

Download
memory/3920-123-0x000001B55E340000-0x000001B560235000-memory.dmp

Filesize
31.0MB

Download
memory/3920-122-0x00007FF9EFDA0000-0x00007FF9F0E8E000-memory.dmp

Filesize
16.9MB

Download
memory/3920-121-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

Filesize
64KB

Download
memory/3920-118-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

Filesize
64KB

Download
memory/3920-117-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

Filesize
64KB

Download
memory/3920-116-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

Filesize
64KB

Download
memory/3920-115-0x00007FF9CF580000-0x00007FF9CF590000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads