dridex | 92a1adc462adbf747ec142eeeab2dc55aa0e809c678116fad23ea8c8a80ad1cf

General

Target

09024a26ea677d735c4a1e3041f73765_JaffaCakes118.dll
Size

1.4MB
MD5

09024a26ea677d735c4a1e3041f73765
SHA1

f624aa4dc24cd5df1546737fed4da1bee587a279
SHA256

92a1adc462adbf747ec142eeeab2dc55aa0e809c678116fad23ea8c8a80ad1cf
SHA512

cfe7cc6a44a331b23eecc95af148e9f220b9ac5eb2b0dc241c29499f9f8d16124ff096c56161d824786034fc11ac054ca37e513494d5522505708fc7c3aa5160
SSDEEP

12288:ddMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:TMIJxSDX3bqjhcfHk7MzH6z

Score

10^/10

dridex botnet evasion payload trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3320-3-0x0000000002720000-0x0000000002721000-memory.dmp	dridex_stager_shellcode

Dridex payload 6 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3604-1-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/3320-51-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/3320-62-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/3604-65-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/2188-72-0x0000000140000000-0x0000000140164000-memory.dmp	dridex_payload
behavioral2/memory/2188-77-0x0000000140000000-0x0000000140164000-memory.dmp	dridex_payload

Executes dropped EXE 1 IoCs

Processes:

systemreset.exe

pid process

2188 systemreset.exe
Loads dropped DLL 1 IoCs

Processes:

systemreset.exe

pid process

2188 systemreset.exe

pid	process
2188	systemreset.exe

pid	process
2188	systemreset.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

systemreset.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	systemreset.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
3604	rundll32.exe
3604	rundll32.exe
3604	rundll32.exe
3604	rundll32.exe
3604	rundll32.exe
3604	rundll32.exe
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320
3320

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3320
Token: SeCreatePagefilePrivilege	3320
Token: SeShutdownPrivilege	3320
Token: SeCreatePagefilePrivilege	3320
Token: SeShutdownPrivilege	3320
Token: SeCreatePagefilePrivilege	3320
Token: SeShutdownPrivilege	3320
Token: SeCreatePagefilePrivilege	3320

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3320
3320

pid	process
3320
3320

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

description	pid	target process
PID 3320 wrote to memory of 1976	3320	systemreset.exe
PID 3320 wrote to memory of 1976	3320	systemreset.exe
PID 3320 wrote to memory of 2188	3320	systemreset.exe
PID 3320 wrote to memory of 2188	3320	systemreset.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\09024a26ea677d735c4a1e3041f73765_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3604

C:\Windows\system32\systemreset.exe
C:\Windows\system32\systemreset.exe
1⤵
PID:1976

C:\Users\Admin\AppData\Local\rIBCRoA\systemreset.exe
C:\Users\Admin\AppData\Local\rIBCRoA\systemreset.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\rIBCRoA\ReAgent.dll
Filesize
1.4MB

MD5
6848247d70e5647d1db8faca6e7b009c

SHA1
965658644a2e555f05ac3da38328beb6b6e83a0b

SHA256
a6deec650ee277ff99c469b545626c67cd4fba6d042237de8da9e912c3e11d74

SHA512
fdc4fbdc2857e36c384d612c67fe3a3c2c247a0b5b0c56d9e73df69c27c8818bc90699a64b3436cd02932d6c5f353bf1021e4a588c04dc3f23e13676ff87bbc0

Download Submit
C:\Users\Admin\AppData\Local\rIBCRoA\systemreset.exe
Filesize
508KB

MD5
325ff647506adb89514defdd1c372194

SHA1
84234ff97d6ddc8a4ea21303ea842aa76a74e0ea

SHA256
ebff6159a7627234f94f606afa2e55e98e1548fd197d22779a5fcff24aa477ad

SHA512
8a9758f4af0264be08d684125827ef11efe651138059f6b463c52476f8a8e1bed94d093042f85893cb3e37c5f3ba7b55c6ce9394595001e661bccbc578da3868

Download Submit
memory/2188-73-0x00000153188B0000-0x00000153188B7000-memory.dmp

Filesize
28KB

Download
memory/2188-77-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/2188-72-0x0000000140000000-0x0000000140164000-memory.dmp

Filesize
1.4MB

Download
memory/3320-27-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-62-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-8-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-9-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-10-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-11-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-13-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-12-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-14-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-15-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-17-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-18-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-19-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-20-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-21-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-16-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-22-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-23-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-24-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-25-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-26-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-5-0x00007FFCAA78A000-0x00007FFCAA78B000-memory.dmp

Filesize
4KB

Download
memory/3320-28-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-7-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-34-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-31-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-33-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-30-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-32-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-35-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-36-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-38-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-39-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-37-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-40-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-41-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-43-0x0000000002640000-0x0000000002647000-memory.dmp

Filesize
28KB

Download
memory/3320-42-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-51-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-52-0x00007FFCAB800000-0x00007FFCAB810000-memory.dmp

Filesize
64KB

Download
memory/3320-53-0x00007FFCAB7F0000-0x00007FFCAB800000-memory.dmp

Filesize
64KB

Download
memory/3320-29-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-6-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3320-3-0x0000000002720000-0x0000000002721000-memory.dmp

Filesize
4KB

Download
memory/3604-0-0x0000020A99A50000-0x0000020A99A57000-memory.dmp

Filesize
28KB

Download
memory/3604-1-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3604-65-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads