dridex | 185136e00027380a18296643ebd7215ee9abe09c5226253b6cc37fe2faef2939

Analysis

max time kernel
149s
max time network
44s
platform
windows7_x64
resource
win7-20220414-en
submitted
17-04-2022 16:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

185136e00027380a18296643ebd7215ee9abe09c5226253b6cc37fe2faef2939.dll
Size

884KB
MD5

616512e689f5521ae81c623cdecc8a7d
SHA1

5b1dd3be9bf23f930ada499f2d3a3ee18c42dc38
SHA256

185136e00027380a18296643ebd7215ee9abe09c5226253b6cc37fe2faef2939
SHA512

91999c6fe02316568a1ac4a69ae08b72558d2ee7c9bc286b7d06e7204785e2f21b939588001dc9a71f0039455b16b6d433bab020b73ebc9f3af2fb228125ed94

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1384-54-0x0000000002170000-0x0000000002171000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

Dxpserver.exerdpclip.execonsent.exe

pid process

1916 Dxpserver.exe
544 rdpclip.exe
1716 consent.exe
Loads dropped DLL 7 IoCs

Processes:

Dxpserver.exerdpclip.execonsent.exe

pid process

1384
1916 Dxpserver.exe
1384
544 rdpclip.exe
1384
1716 consent.exe
1384

pid	process
1916	Dxpserver.exe
544	rdpclip.exe
1716	consent.exe

pid	process
1384
1916	Dxpserver.exe
1384
544	rdpclip.exe
1384
1716	consent.exe
1384

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gcehmtlftxqmyqm = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\9.0\\dp\\rdpclip.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeDxpserver.exerdpclip.execonsent.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Dxpserver.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpclip.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	consent.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeDxpserver.exerdpclip.exe

pid	process
1120	rundll32.exe
1120	rundll32.exe
1120	rundll32.exe
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1916	Dxpserver.exe
1916	Dxpserver.exe
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
1384
544	rdpclip.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1384 wrote to memory of 844	1384	Dxpserver.exe
PID 1384 wrote to memory of 844	1384	Dxpserver.exe
PID 1384 wrote to memory of 844	1384	Dxpserver.exe
PID 1384 wrote to memory of 1916	1384	Dxpserver.exe
PID 1384 wrote to memory of 1916	1384	Dxpserver.exe
PID 1384 wrote to memory of 1916	1384	Dxpserver.exe
PID 1384 wrote to memory of 1824	1384	rdpclip.exe
PID 1384 wrote to memory of 1824	1384	rdpclip.exe
PID 1384 wrote to memory of 1824	1384	rdpclip.exe
PID 1384 wrote to memory of 544	1384	rdpclip.exe
PID 1384 wrote to memory of 544	1384	rdpclip.exe
PID 1384 wrote to memory of 544	1384	rdpclip.exe
PID 1384 wrote to memory of 1296	1384	consent.exe
PID 1384 wrote to memory of 1296	1384	consent.exe
PID 1384 wrote to memory of 1296	1384	consent.exe
PID 1384 wrote to memory of 1716	1384	consent.exe
PID 1384 wrote to memory of 1716	1384	consent.exe
PID 1384 wrote to memory of 1716	1384	consent.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\185136e00027380a18296643ebd7215ee9abe09c5226253b6cc37fe2faef2939.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1120

C:\Windows\system32\Dxpserver.exe
C:\Windows\system32\Dxpserver.exe
1⤵
PID:844

C:\Users\Admin\AppData\Local\vNL\Dxpserver.exe
C:\Users\Admin\AppData\Local\vNL\Dxpserver.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Windows\system32\rdpclip.exe
C:\Windows\system32\rdpclip.exe
1⤵
PID:1824

C:\Users\Admin\AppData\Local\jnoMO\rdpclip.exe
C:\Users\Admin\AppData\Local\jnoMO\rdpclip.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:544

C:\Windows\system32\consent.exe
C:\Windows\system32\consent.exe
1⤵
PID:1296

C:\Users\Admin\AppData\Local\iq8A\consent.exe
C:\Users\Admin\AppData\Local\iq8A\consent.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1716

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\iq8A\WINMM.dll
Filesize
889KB

MD5
1789974191e8b52faf8cae5192810aa4

SHA1
e25e9650cb9e9f2cef7802e0d1c4b905803e61ef

SHA256
891ecbad115091ed099ea1d382141b8d0c8889703b2424667ef0135981e979e1

SHA512
de87ca2bca934a1a1deece43658d6152d16072320dce9db1f729f2f3e7c1ba18f313863107efa81177feceedc94fe8667919bc757cf07f7ecea918b989467e4e

Download Submit
C:\Users\Admin\AppData\Local\iq8A\consent.exe
Filesize
109KB

MD5
0b5511674394666e9d221f8681b2c2e6

SHA1
6e4e720dfc424a12383f0b8194e4477e3bc346dc

SHA256
ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

SHA512
00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

Download Submit
C:\Users\Admin\AppData\Local\jnoMO\WTSAPI32.dll
Filesize
886KB

MD5
671319ce5303d84eb585f253a0ad8500

SHA1
3a9539fbb05654d3fc9da000568dfa7d173d9023

SHA256
5ea9b2c272543aa1e3867154ad5873ca29d2e3107aa2439fcfbff61887d22081

SHA512
7b067427b74335a52364a99cd71e3c57d5a84b6fbfe9b79b85f1ff96f7e55c0b84317034a133c0044245e0f4694f50a14676e23e55c2bb0bd3f11eeda351d250

Download Submit
C:\Users\Admin\AppData\Local\jnoMO\rdpclip.exe
Filesize
206KB

MD5
25d284eb2f12254c001afe9a82575a81

SHA1
cf131801fdd5ec92278f9e0ae62050e31c6670a5

SHA256
837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b

SHA512
7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

Download Submit
C:\Users\Admin\AppData\Local\vNL\Dxpserver.exe
Filesize
259KB

MD5
4d38389fb92e43c77a524fd96dbafd21

SHA1
08014e52f6894cad4f1d1e6fc1a703732e9acd19

SHA256
070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73

SHA512
02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

Download Submit
C:\Users\Admin\AppData\Local\vNL\dwmapi.dll
Filesize
886KB

MD5
e33ad60f7dfe749118d66244ce557c7e

SHA1
f06214af720ae78b389c93991a5c16987dc0c817

SHA256
410a374a4b3753f539db22c4cd7ae02f75c5e8c69f8876197eaf843df8ea12c2

SHA512
413b73ed27b37389ca580fb69ab11fbe0a09402fac2160cdc2b58e46e90318c7c1f48f8e11d04300eccef1db48eb2219a1be0e909b6c65680ff585ab8a0a37db

Download Submit
\Users\Admin\AppData\Local\iq8A\WINMM.dll
Filesize
889KB

MD5
1789974191e8b52faf8cae5192810aa4

SHA1
e25e9650cb9e9f2cef7802e0d1c4b905803e61ef

SHA256
891ecbad115091ed099ea1d382141b8d0c8889703b2424667ef0135981e979e1

SHA512
de87ca2bca934a1a1deece43658d6152d16072320dce9db1f729f2f3e7c1ba18f313863107efa81177feceedc94fe8667919bc757cf07f7ecea918b989467e4e

Download Submit
\Users\Admin\AppData\Local\iq8A\consent.exe
Filesize
109KB

MD5
0b5511674394666e9d221f8681b2c2e6

SHA1
6e4e720dfc424a12383f0b8194e4477e3bc346dc

SHA256
ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

SHA512
00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

Download Submit
\Users\Admin\AppData\Local\jnoMO\WTSAPI32.dll
Filesize
886KB

MD5
671319ce5303d84eb585f253a0ad8500

SHA1
3a9539fbb05654d3fc9da000568dfa7d173d9023

SHA256
5ea9b2c272543aa1e3867154ad5873ca29d2e3107aa2439fcfbff61887d22081

SHA512
7b067427b74335a52364a99cd71e3c57d5a84b6fbfe9b79b85f1ff96f7e55c0b84317034a133c0044245e0f4694f50a14676e23e55c2bb0bd3f11eeda351d250

Download Submit
\Users\Admin\AppData\Local\jnoMO\rdpclip.exe
Filesize
206KB

MD5
25d284eb2f12254c001afe9a82575a81

SHA1
cf131801fdd5ec92278f9e0ae62050e31c6670a5

SHA256
837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b

SHA512
7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

Download Submit
\Users\Admin\AppData\Local\vNL\Dxpserver.exe
Filesize
259KB

MD5
4d38389fb92e43c77a524fd96dbafd21

SHA1
08014e52f6894cad4f1d1e6fc1a703732e9acd19

SHA256
070bc95c486c15d2edc3548ba416dc9565ead401cb03a0472f719fb55ac94e73

SHA512
02d8d130cff2b8de15139d309e1cd74a2148bb786fd749e5f22775d45e193b0f75adf40274375cabce33576480ff20456f25172d29a034cd134b8084d40a67ba

Download Submit
\Users\Admin\AppData\Local\vNL\dwmapi.dll
Filesize
886KB

MD5
e33ad60f7dfe749118d66244ce557c7e

SHA1
f06214af720ae78b389c93991a5c16987dc0c817

SHA256
410a374a4b3753f539db22c4cd7ae02f75c5e8c69f8876197eaf843df8ea12c2

SHA512
413b73ed27b37389ca580fb69ab11fbe0a09402fac2160cdc2b58e46e90318c7c1f48f8e11d04300eccef1db48eb2219a1be0e909b6c65680ff585ab8a0a37db

Download Submit
\Users\Admin\AppData\Roaming\Adobe\Flash Player\AssetCache\8X1i\consent.exe
Filesize
109KB

MD5
0b5511674394666e9d221f8681b2c2e6

SHA1
6e4e720dfc424a12383f0b8194e4477e3bc346dc

SHA256
ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

SHA512
00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

Download Submit
memory/544-74-0x0000000000000000-mapping.dmp

Download
memory/1384-58-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-59-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-66-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-54-0x0000000002170000-0x0000000002171000-memory.dmp

Filesize
4KB

Download
memory/1384-63-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-62-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-67-0x0000000077400000-0x0000000077402000-memory.dmp

Filesize
8KB

Download
memory/1384-61-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-60-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-64-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-57-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-55-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-65-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1384-56-0x0000000140000000-0x00000001400E1000-memory.dmp

Filesize
900KB

Download
memory/1716-79-0x0000000000000000-mapping.dmp

Download
memory/1716-83-0x000007FEFBAA1000-0x000007FEFBAA3000-memory.dmp

Filesize
8KB

Download
memory/1916-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads