dridex | 6f22b406ce7ba1aae300c8e36d4b83e6906792dccfcf943a9f47204624186399

Analysis

max time kernel
162s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
26-03-2022 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6f22b406ce7ba1aae300c8e36d4b83e6906792dccfcf943a9f47204624186399.dll
Size

1.2MB
MD5

d17d0d38b37ae7db80db3c395776973f
SHA1

da12df02ea9f306bf7416d91c81f736d82ea7ca2
SHA256

6f22b406ce7ba1aae300c8e36d4b83e6906792dccfcf943a9f47204624186399
SHA512

a5aebe082e97b01eb525113d93cd60c485e93aea3aafae3fcac3850cc5f60bd709a06ca92ad318985e1f7203af0e080edb4e97a7433b87f076c61ab0b3a82ec9

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Payload 2 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/4532-130-0x0000000140000000-0x0000000140133000-memory.dmp	dridex_payload
behavioral2/memory/3188-161-0x0000000140000000-0x0000000140134000-memory.dmp	dridex_payload

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/992-134-0x0000000000A30000-0x0000000000A31000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

LockScreenContentServer.exedxgiadaptercache.exeBdeUISrv.exe

pid process

3188 LockScreenContentServer.exe
816 dxgiadaptercache.exe
936 BdeUISrv.exe
Loads dropped DLL 4 IoCs

Processes:

LockScreenContentServer.exedxgiadaptercache.exeBdeUISrv.exe

pid process

3188 LockScreenContentServer.exe
816 dxgiadaptercache.exe
816 dxgiadaptercache.exe
936 BdeUISrv.exe

pid	process
3188	LockScreenContentServer.exe
816	dxgiadaptercache.exe
936	BdeUISrv.exe

pid	process
3188	LockScreenContentServer.exe
816	dxgiadaptercache.exe
816	dxgiadaptercache.exe
936	BdeUISrv.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zrakajr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\lwMzQ\\dxgiadaptercache.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeLockScreenContentServer.exedxgiadaptercache.exeBdeUISrv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	LockScreenContentServer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dxgiadaptercache.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BdeUISrv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
4532	rundll32.exe
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992
992

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

992
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

description pid process

Token: SeShutdownPrivilege 992
Token: SeCreatePagefilePrivilege 992

pid	process
992

description	pid	process
Token: SeShutdownPrivilege	992
Token: SeCreatePagefilePrivilege	992

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 992 wrote to memory of 4568	992	LockScreenContentServer.exe
PID 992 wrote to memory of 4568	992	LockScreenContentServer.exe
PID 992 wrote to memory of 3188	992	LockScreenContentServer.exe
PID 992 wrote to memory of 3188	992	LockScreenContentServer.exe
PID 992 wrote to memory of 1420	992	dxgiadaptercache.exe
PID 992 wrote to memory of 1420	992	dxgiadaptercache.exe
PID 992 wrote to memory of 816	992	dxgiadaptercache.exe
PID 992 wrote to memory of 816	992	dxgiadaptercache.exe
PID 992 wrote to memory of 2824	992	BdeUISrv.exe
PID 992 wrote to memory of 2824	992	BdeUISrv.exe
PID 992 wrote to memory of 936	992	BdeUISrv.exe
PID 992 wrote to memory of 936	992	BdeUISrv.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6f22b406ce7ba1aae300c8e36d4b83e6906792dccfcf943a9f47204624186399.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Windows\system32\LockScreenContentServer.exe
C:\Windows\system32\LockScreenContentServer.exe
1⤵
PID:4568

C:\Users\Admin\AppData\Local\OX9HK\LockScreenContentServer.exe
C:\Users\Admin\AppData\Local\OX9HK\LockScreenContentServer.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3188

C:\Windows\system32\dxgiadaptercache.exe
C:\Windows\system32\dxgiadaptercache.exe
1⤵
PID:1420

C:\Users\Admin\AppData\Local\5UOeT\dxgiadaptercache.exe
C:\Users\Admin\AppData\Local\5UOeT\dxgiadaptercache.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:816

C:\Windows\system32\BdeUISrv.exe
C:\Windows\system32\BdeUISrv.exe
1⤵
PID:2824

C:\Users\Admin\AppData\Local\zbVp3Yoj\BdeUISrv.exe
C:\Users\Admin\AppData\Local\zbVp3Yoj\BdeUISrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:936

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\5UOeT\dxgi.dll
Filesize
1.2MB

MD5
ffade66aa3bd8565ed004c19d1752d71

SHA1
1b632c459d06352470837c3444fa50d554731137

SHA256
56a90dad72be7250718edf4a10c8c1124ef4c5003eb2d91b756793c86d3805ea

SHA512
669581b1e465a8074737421d694338f6212fd7ef9466e0a17f19b372b3d77d11510ac5abd17112b01a399d9ab8decb167501ec1b602662fcf86aee199c687a4e

Download Submit
C:\Users\Admin\AppData\Local\5UOeT\dxgi.dll
Filesize
1.2MB

MD5
ffade66aa3bd8565ed004c19d1752d71

SHA1
1b632c459d06352470837c3444fa50d554731137

SHA256
56a90dad72be7250718edf4a10c8c1124ef4c5003eb2d91b756793c86d3805ea

SHA512
669581b1e465a8074737421d694338f6212fd7ef9466e0a17f19b372b3d77d11510ac5abd17112b01a399d9ab8decb167501ec1b602662fcf86aee199c687a4e

Download Submit
C:\Users\Admin\AppData\Local\5UOeT\dxgi.dll
Filesize
1.2MB

MD5
ffade66aa3bd8565ed004c19d1752d71

SHA1
1b632c459d06352470837c3444fa50d554731137

SHA256
56a90dad72be7250718edf4a10c8c1124ef4c5003eb2d91b756793c86d3805ea

SHA512
669581b1e465a8074737421d694338f6212fd7ef9466e0a17f19b372b3d77d11510ac5abd17112b01a399d9ab8decb167501ec1b602662fcf86aee199c687a4e

Download Submit
C:\Users\Admin\AppData\Local\5UOeT\dxgiadaptercache.exe
Filesize
230KB

MD5
e62f89130b7253f7780a862ed9aff294

SHA1
b031e64a36e93f95f2061be5b0383069efac2070

SHA256
4bea9f741fe4ca9d6262477849896b9fa6377326d11af044561c31bde2d994b5

SHA512
05649d38a0b5d825bb8442549427b0ff77b139c9dd297b04d6c0fb1415504c95ed750cd79efea2ff514abfc5d1003e6251a3cd871d352dcea06be0cdeb0304f7

Download Submit
C:\Users\Admin\AppData\Local\OX9HK\LockScreenContentServer.exe
Filesize
47KB

MD5
a0b7513c98cf46ca2cea3a567fec137c

SHA1
2307fc8e3fc620ea3c2fdc6248ad4658479ba995

SHA256
cb2278884f04fd34753f7a20e5865ef5fc4fa47c28df9ac14ad6e922713af8c6

SHA512
3928485a60ffa7f2d2b7d0be51863e1f8197578cfb397f1086a1ab5132843a23bbc4042b04b5d01fafad04878bd839161fa492d0cf1a6bac6be92023cdee3d15

Download Submit
C:\Users\Admin\AppData\Local\OX9HK\dwmapi.dll
Filesize
1.2MB

MD5
8ce7ba38f09892e44a228de8e45b8234

SHA1
a369cc8b3ede1d7babcfd1318b16272ba7450074

SHA256
d99b4077b598770331b692b7ffa8d81240a1373baa4390f31b07ea8dcab75639

SHA512
d978031c761f49df4490c24ab0794fa02517dce72d8881e358623b9d9912b2d9d8b3794ed6a63d65a9a6248d35efba6e3485d93d6e08d97e5eee36c9215cecd4

Download Submit
C:\Users\Admin\AppData\Local\OX9HK\dwmapi.dll
Filesize
1.2MB

MD5
8ce7ba38f09892e44a228de8e45b8234

SHA1
a369cc8b3ede1d7babcfd1318b16272ba7450074

SHA256
d99b4077b598770331b692b7ffa8d81240a1373baa4390f31b07ea8dcab75639

SHA512
d978031c761f49df4490c24ab0794fa02517dce72d8881e358623b9d9912b2d9d8b3794ed6a63d65a9a6248d35efba6e3485d93d6e08d97e5eee36c9215cecd4

Download Submit
C:\Users\Admin\AppData\Local\zbVp3Yoj\BdeUISrv.exe
Filesize
54KB

MD5
8595075667ff2c9a9f9e2eebc62d8f53

SHA1
c48b54e571f05d4e21d015bb3926c2129f19191a

SHA256
20b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db

SHA512
080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88

Download Submit
C:\Users\Admin\AppData\Local\zbVp3Yoj\WTSAPI32.dll
Filesize
1.2MB

MD5
b9bd54677b5727b71adc65aac1586094

SHA1
8823bd7d4f7ddb8414e178aa3dd57d4297a901e7

SHA256
a39c5696495e06c0a46e417f3c5564d572a0454f99ddd060e6d3b42622b2754a

SHA512
854c36969527efeb84bde11046be75e198855f56c91acd8d3a7d19b5eba74642bd740ab25b4cfb953ad4faf27fdd542a2ed169950a70bc63d42ede81520cdc6c

Download Submit
C:\Users\Admin\AppData\Local\zbVp3Yoj\WTSAPI32.dll
Filesize
1.2MB

MD5
b9bd54677b5727b71adc65aac1586094

SHA1
8823bd7d4f7ddb8414e178aa3dd57d4297a901e7

SHA256
a39c5696495e06c0a46e417f3c5564d572a0454f99ddd060e6d3b42622b2754a

SHA512
854c36969527efeb84bde11046be75e198855f56c91acd8d3a7d19b5eba74642bd740ab25b4cfb953ad4faf27fdd542a2ed169950a70bc63d42ede81520cdc6c

Download Submit
memory/816-173-0x000001FA47220000-0x000001FA47227000-memory.dmp

Filesize
28KB

Download
memory/816-165-0x0000000000000000-mapping.dmp

Download
memory/936-174-0x0000000000000000-mapping.dmp

Download
memory/936-178-0x000002259D6B0000-0x000002259D6B7000-memory.dmp

Filesize
28KB

Download
memory/992-141-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-143-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-155-0x00007FFC2043C000-0x00007FFC2043D000-memory.dmp

Filesize
4KB

Download
memory/992-134-0x0000000000A30000-0x0000000000A31000-memory.dmp

Filesize
4KB

Download
memory/992-154-0x0000000000A40000-0x0000000000A47000-memory.dmp

Filesize
28KB

Download
memory/992-145-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-144-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-135-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-136-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-156-0x00007FFC2040C000-0x00007FFC2040D000-memory.dmp

Filesize
4KB

Download
memory/992-142-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-140-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-137-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-139-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/992-138-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/3188-164-0x000001EDFB860000-0x000001EDFB867000-memory.dmp

Filesize
28KB

Download
memory/3188-161-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/3188-157-0x0000000000000000-mapping.dmp

Download
memory/4532-130-0x0000000140000000-0x0000000140133000-memory.dmp

Filesize
1.2MB

Download
memory/4532-133-0x0000021CDE9E0000-0x0000021CDE9E7000-memory.dmp

Filesize
28KB

Download