dridex | 8aa74696ec333711aeac0f9177f7fd7e5d5877f72071596b81157bcab607329a

Analysis

max time kernel
185s
max time network
183s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
17-04-2022 15:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa74696ec333711aeac0f9177f7fd7e5d5877f72071596b81157bcab607329a.dll
Size

878KB
MD5

9865db9e9f88fa6da0a98826e59591dc
SHA1

0af819b9bf7c60c53b5af71498dddaf27e0cd723
SHA256

8aa74696ec333711aeac0f9177f7fd7e5d5877f72071596b81157bcab607329a
SHA512

be508bf583f29db78aac7fd31a8b6345de02d03c27e4ff2cf3143ccdaa09a577ba594d6fa755ff3ca9d97fc218ed0d3194135a4513938110af2a399d1a9c4e43

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3136-130-0x0000000001420000-0x0000000001421000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

systemreset.exeDmNotificationBroker.exePasswordOnWakeSettingFlyout.exe

pid process

3128 systemreset.exe
1764 DmNotificationBroker.exe
824 PasswordOnWakeSettingFlyout.exe
Loads dropped DLL 3 IoCs

Processes:

systemreset.exeDmNotificationBroker.exePasswordOnWakeSettingFlyout.exe

pid process

3128 systemreset.exe
1764 DmNotificationBroker.exe
824 PasswordOnWakeSettingFlyout.exe

pid	process
3128	systemreset.exe
1764	DmNotificationBroker.exe
824	PasswordOnWakeSettingFlyout.exe

pid	process
3128	systemreset.exe
1764	DmNotificationBroker.exe
824	PasswordOnWakeSettingFlyout.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Eqzhtortkjjc = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\SYSTEM~1\\ZyB84Bs\\DMNOTI~1.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exesystemreset.exeDmNotificationBroker.exePasswordOnWakeSettingFlyout.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	systemreset.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DmNotificationBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PasswordOnWakeSettingFlyout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1172	rundll32.exe
1172	rundll32.exe
1172	rundll32.exe
1172	rundll32.exe
1172	rundll32.exe
1172	rundll32.exe
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136
3136

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3136

pid	process
3136

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3136 wrote to memory of 2948	3136	systemreset.exe
PID 3136 wrote to memory of 2948	3136	systemreset.exe
PID 3136 wrote to memory of 3128	3136	systemreset.exe
PID 3136 wrote to memory of 3128	3136	systemreset.exe
PID 3136 wrote to memory of 828	3136	DmNotificationBroker.exe
PID 3136 wrote to memory of 828	3136	DmNotificationBroker.exe
PID 3136 wrote to memory of 1764	3136	DmNotificationBroker.exe
PID 3136 wrote to memory of 1764	3136	DmNotificationBroker.exe
PID 3136 wrote to memory of 1328	3136	PasswordOnWakeSettingFlyout.exe
PID 3136 wrote to memory of 1328	3136	PasswordOnWakeSettingFlyout.exe
PID 3136 wrote to memory of 824	3136	PasswordOnWakeSettingFlyout.exe
PID 3136 wrote to memory of 824	3136	PasswordOnWakeSettingFlyout.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\8aa74696ec333711aeac0f9177f7fd7e5d5877f72071596b81157bcab607329a.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1172

C:\Windows\system32\systemreset.exe
C:\Windows\system32\systemreset.exe
1⤵
PID:2948

C:\Users\Admin\AppData\Local\dO3ASuC\systemreset.exe
C:\Users\Admin\AppData\Local\dO3ASuC\systemreset.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3128

C:\Windows\system32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
1⤵
PID:828

C:\Users\Admin\AppData\Local\9pq1bX91\DmNotificationBroker.exe
C:\Users\Admin\AppData\Local\9pq1bX91\DmNotificationBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1764

C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
C:\Windows\system32\PasswordOnWakeSettingFlyout.exe
1⤵
PID:1328

C:\Users\Admin\AppData\Local\U3xZc1\PasswordOnWakeSettingFlyout.exe
C:\Users\Admin\AppData\Local\U3xZc1\PasswordOnWakeSettingFlyout.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\9pq1bX91\DUI70.dll
Filesize
1.1MB

MD5
6f82137f9ff77f5e68aafd47ad013967

SHA1
0a63d2b58e3e4edce0258313b3d11b8c1f9a5eeb

SHA256
f685892a233dff6aec2abe4980075fbdb693fd9ec40a0491b78595aa86a7c512

SHA512
e0903cc989e7daacf0dc35361bf12e68fab1576e852a5fa0ca1187e11c8368344c90f07e8e506995495fa68955b461b7b8196a9669b8367840facbe428ffd50f

Download Submit
C:\Users\Admin\AppData\Local\9pq1bX91\DUI70.dll
Filesize
1.1MB

MD5
6f82137f9ff77f5e68aafd47ad013967

SHA1
0a63d2b58e3e4edce0258313b3d11b8c1f9a5eeb

SHA256
f685892a233dff6aec2abe4980075fbdb693fd9ec40a0491b78595aa86a7c512

SHA512
e0903cc989e7daacf0dc35361bf12e68fab1576e852a5fa0ca1187e11c8368344c90f07e8e506995495fa68955b461b7b8196a9669b8367840facbe428ffd50f

Download Submit
C:\Users\Admin\AppData\Local\9pq1bX91\DmNotificationBroker.exe
Filesize
32KB

MD5
f0bdc20540d314a2aad951c7e2c88420

SHA1
4ab344595a4a81ab5f31ed96d72f217b4cee790b

SHA256
f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5

SHA512
cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

Download Submit
C:\Users\Admin\AppData\Local\U3xZc1\PasswordOnWakeSettingFlyout.exe
Filesize
44KB

MD5
591a98c65f624c52882c2b238d6cd4c4

SHA1
c960d08c19d777069cf265dcc281807fbd8502d7

SHA256
5e6ed524c955fb1ea3e24f132987143da3ec81db5041a0edcfa7bf3ac790eb06

SHA512
1999f23c90d85857461f8ddc5342470296f6939a654ac015780c2977f293c1f799fc992462f3d4d9181c97ab960db3291b85ea7c0537edcb57755706b20b6074

Download Submit
C:\Users\Admin\AppData\Local\U3xZc1\UxTheme.dll
Filesize
881KB

MD5
72dfa753e5bb677b0dec7cb42cf5e578

SHA1
a097b5865a9e368c38457f2ebbe94aea6dad81bf

SHA256
a48d25fb22f95cea1e703e9cced8257168dfe1e3f963f581dc9c13ca5046de1d

SHA512
56027061d7fbcfd2bf7b47806ea9d12e445210e8037a6a04f97cd5fde765a3f50104345ea27488cd6774cfada6e908fe4f395de39dec34ba7c756b30b4c81f70

Download Submit
C:\Users\Admin\AppData\Local\U3xZc1\UxTheme.dll
Filesize
881KB

MD5
72dfa753e5bb677b0dec7cb42cf5e578

SHA1
a097b5865a9e368c38457f2ebbe94aea6dad81bf

SHA256
a48d25fb22f95cea1e703e9cced8257168dfe1e3f963f581dc9c13ca5046de1d

SHA512
56027061d7fbcfd2bf7b47806ea9d12e445210e8037a6a04f97cd5fde765a3f50104345ea27488cd6774cfada6e908fe4f395de39dec34ba7c756b30b4c81f70

Download Submit
C:\Users\Admin\AppData\Local\dO3ASuC\ReAgent.dll
Filesize
880KB

MD5
dd1771c9b127e86cf943f65fb5b8d655

SHA1
8713cdccfec3da3e0304a9e8df377450b4c2b43a

SHA256
1f3d91bccca4145df6ab3f063be371296942ac253a1eaa2740f57aaf8d23718a

SHA512
d68dcb221f58b7e5f20f35aa86262a2ebd63ffd6b839f91039b4cc16ba2c33aa871c12cbaad043603c53cd3bb4d7c4a61a0760a49c1a6a1ae8be5e34d3f0ad9c

Download Submit
C:\Users\Admin\AppData\Local\dO3ASuC\ReAgent.dll
Filesize
880KB

MD5
dd1771c9b127e86cf943f65fb5b8d655

SHA1
8713cdccfec3da3e0304a9e8df377450b4c2b43a

SHA256
1f3d91bccca4145df6ab3f063be371296942ac253a1eaa2740f57aaf8d23718a

SHA512
d68dcb221f58b7e5f20f35aa86262a2ebd63ffd6b839f91039b4cc16ba2c33aa871c12cbaad043603c53cd3bb4d7c4a61a0760a49c1a6a1ae8be5e34d3f0ad9c

Download Submit
C:\Users\Admin\AppData\Local\dO3ASuC\systemreset.exe
Filesize
508KB

MD5
325ff647506adb89514defdd1c372194

SHA1
84234ff97d6ddc8a4ea21303ea842aa76a74e0ea

SHA256
ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad

SHA512
8a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868

Download Submit
memory/824-152-0x0000000000000000-mapping.dmp

Download
memory/1764-148-0x0000000000000000-mapping.dmp

Download
memory/3128-144-0x0000000000000000-mapping.dmp

Download
memory/3136-139-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-140-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-142-0x00007FF9068AC000-0x00007FF9068AD000-memory.dmp

Filesize
4KB

Download
memory/3136-141-0x00007FF9068DC000-0x00007FF9068DD000-memory.dmp

Filesize
4KB

Download
memory/3136-131-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-136-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-137-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-143-0x00007FF9067F0000-0x00007FF906800000-memory.dmp

Filesize
64KB

Download
memory/3136-130-0x0000000001420000-0x0000000001421000-memory.dmp

Filesize
4KB

Download
memory/3136-138-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-135-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-134-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-133-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download
memory/3136-132-0x0000000140000000-0x00000001400DF000-memory.dmp

Filesize
892KB

Download