dridex | bb989b8a563ee7a14473a127b7510b04c2bf8d2e03d863e761f6f7697c5bb05d

Analysis

max time kernel
106s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f20adeaee7a762965e7a010eeecaedb0_JaffaCakes118.dll
Size

1.5MB
MD5

f20adeaee7a762965e7a010eeecaedb0
SHA1

64978ed23c7de4cd2e36f1b9a1e72934b81ee546
SHA256

bb989b8a563ee7a14473a127b7510b04c2bf8d2e03d863e761f6f7697c5bb05d
SHA512

8dd2eb8824d4d50cec03b62bed3e11569b3cfbac0483c11bab48fb1707f3482446b343da8819b367e513af9180b652c416ef223e1e99584d4583fd15af49df54
SSDEEP

12288:IVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:dfP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3348-4-0x0000000002960000-0x0000000002961000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

wermgr.exemmc.exeshrpubw.exe

pid process

4392 wermgr.exe
5000 mmc.exe
5112 shrpubw.exe
Loads dropped DLL 3 IoCs

Processes:

wermgr.exemmc.exeshrpubw.exe

pid process

4392 wermgr.exe
5000 mmc.exe
5112 shrpubw.exe

pid	process
4392	wermgr.exe
5000	mmc.exe
5112	shrpubw.exe

pid	process
4392	wermgr.exe
5000	mmc.exe
5112	shrpubw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xcdbzlxvqxxhz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SlbCvCBa06M\\mmc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

mmc.exeshrpubw.exerundll32.exewermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mmc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	shrpubw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wermgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe
1600	rundll32.exe
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348
3348

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3348 wrote to memory of 4008	3348	wermgr.exe
PID 3348 wrote to memory of 4008	3348	wermgr.exe
PID 3348 wrote to memory of 4392	3348	wermgr.exe
PID 3348 wrote to memory of 4392	3348	wermgr.exe
PID 3348 wrote to memory of 3308	3348	mmc.exe
PID 3348 wrote to memory of 3308	3348	mmc.exe
PID 3348 wrote to memory of 5000	3348	mmc.exe
PID 3348 wrote to memory of 5000	3348	mmc.exe
PID 3348 wrote to memory of 4632	3348	shrpubw.exe
PID 3348 wrote to memory of 4632	3348	shrpubw.exe
PID 3348 wrote to memory of 5112	3348	shrpubw.exe
PID 3348 wrote to memory of 5112	3348	shrpubw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\f20adeaee7a762965e7a010eeecaedb0_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1600

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
1⤵
PID:4008

C:\Users\Admin\AppData\Local\WcFx2EPWv\wermgr.exe
C:\Users\Admin\AppData\Local\WcFx2EPWv\wermgr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4392

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe
1⤵
PID:3308

C:\Users\Admin\AppData\Local\CEZqnZvy\mmc.exe
C:\Users\Admin\AppData\Local\CEZqnZvy\mmc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5000

C:\Windows\system32\shrpubw.exe
C:\Windows\system32\shrpubw.exe
1⤵
PID:4632

C:\Users\Admin\AppData\Local\Rd8x1age\shrpubw.exe
C:\Users\Admin\AppData\Local\Rd8x1age\shrpubw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1036 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CEZqnZvy\mmc.exe

Filesize
1.8MB

MD5
8c86b80518406f14a4952d67185032d6

SHA1
9269f1fbcf65fefbc88a2e239519c21efe0f6ba5

SHA256
895eef1eda5700a425934ae3782d4741dfefb7deafa53891bde490150187b98a

SHA512
1bbdaa3ae8b5716ad2bd517055533e286ddb8a6c23cbc7aa602143dbb1ae132b513088ab61527c49737c554269c51416cceb80206ac8128ac6b003f1864eb099

Download Submit
C:\Users\Admin\AppData\Local\CEZqnZvy\mmcbase.DLL

Filesize
1.5MB

MD5
8fa514c2bee0a006f85fdc3f44998e54

SHA1
e10217a7fdff7f8010fce8fd0053d42e5163224c

SHA256
493cc3ae3a25a3aa2574cf5a4e2c38d7a1e290183d7fd4818f817bae181f002c

SHA512
19b8db30f3bfc730cf12547a6ae1f52662eacd681245e2d5c204116b60335fd662f73b6252a2b8ce3456ee081a2f11e1fb55a27ac8defb348d671504ac92d374

Download Submit
C:\Users\Admin\AppData\Local\Rd8x1age\shrpubw.exe

Filesize
59KB

MD5
9910d5c62428ec5f92b04abf9428eec9

SHA1
05f27d7515e8ae1fa3bc974ec65b864ec4c9ac8b

SHA256
6b84e6e55d8572d7edf0b6243d00abb651fcb0cddddac8461de5f9bb80035a2e

SHA512
01be043f7ff879a683e53962eec58456ba200d6787ea66581bb62669ae65d5e58a5577cdf23441165f7a535fce1dec933e3ad2465c72172b4a1488b24ce722cb

Download Submit
C:\Users\Admin\AppData\Local\Rd8x1age\srvcli.dll

Filesize
1.5MB

MD5
120af2e97e71064e5c722fcf998ef7a7

SHA1
4737c9f91ff61f89311250f554f7e95868dccc30

SHA256
d2852d997c23a9df5e82506fbd2af7abef34c5bc469c9d62036bdaf8c35df99d

SHA512
5e1c27ea178352d3606877d471c4acba7b90ff5445b2499e4e16ed91fcc204f50434ed32950aed7770716c21b01b659f7e20d4346f7330e8a1337e0371596033

Download Submit
C:\Users\Admin\AppData\Local\WcFx2EPWv\wer.dll

Filesize
1.5MB

MD5
1b13e96fafbe2d0647d1045385b8addb

SHA1
167abc00d0d4c12324e60fa0d47a94d32c62be3c

SHA256
e9f00fa3f423713e8a8c9e7b8977e7b3a560658e4bf1e75f3c6f839af2b21347

SHA512
04b9fa5f9bc926dd2c05df70ce28917d402a7c2321b1c0d9b32dfb6bfe07fe211dd206ff7d8724c5575cf4b27e342a7db11b6d1cd9e7c58f45f6129f3c6bfdd4

Download Submit
C:\Users\Admin\AppData\Local\WcFx2EPWv\wermgr.exe

Filesize
223KB

MD5
f7991343cf02ed92cb59f394e8b89f1f

SHA1
573ad9af63a6a0ab9b209ece518fd582b54cfef5

SHA256
1c09759dcd31fdc81bcd6685438d7efb34e0229f1096bfd57d41ecfe614d07dc

SHA512
fa3cf314100f5340c7d0f6a70632a308fcadb4b48785753310a053a510169979a89637b8b4fedf4d3690db6b8b55146e323cad70d704c4e2ede4edff5284237d

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Axoeay.lnk

Filesize
1KB

MD5
4e294c86e5703034d35a542cb11dbcbb

SHA1
baa09bf0d81d4f9a2ce17ef72c742bede2890337

SHA256
01b64e2642e0cd7e94efa1b0355e295dfc88ab3e4fa728e3fcd77de016d28ad9

SHA512
9e09d725a8c088a64cdc706173fdefbeda01eefff7d24cf9f0c8029c8ca6a758ab7cf20d7d3882b0a07165bfb91728a52953a145cc1b4bd4bf2a60b2a889eb4d

Download Submit
memory/1600-1-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/1600-0-0x0000020DE4EC0000-0x0000020DE4EC7000-memory.dmp

Filesize
28KB

Download
memory/1600-8-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-29-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-36-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-11-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-12-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-13-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-14-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-15-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-17-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-16-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-18-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-19-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-20-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-21-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-22-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-23-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-24-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-25-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-26-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-27-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-28-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-9-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-30-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-31-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-32-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-34-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-10-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-35-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-33-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-38-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-37-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-39-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-41-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-40-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-42-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-43-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-45-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-44-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-46-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-47-0x0000000000B50000-0x0000000000B57000-memory.dmp

Filesize
28KB

Download
memory/3348-54-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-55-0x00007FF9A6720000-0x00007FF9A6730000-memory.dmp

Filesize
64KB

Download
memory/3348-64-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-66-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/3348-5-0x00007FF9A668A000-0x00007FF9A668B000-memory.dmp

Filesize
4KB

Download
memory/3348-4-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/3348-7-0x0000000140000000-0x0000000140184000-memory.dmp

Filesize
1.5MB

Download
memory/4392-81-0x0000000140000000-0x0000000140186000-memory.dmp

Filesize
1.5MB

Download
memory/4392-75-0x0000000140000000-0x0000000140186000-memory.dmp

Filesize
1.5MB

Download
memory/4392-76-0x00000174084A0000-0x00000174084A7000-memory.dmp

Filesize
28KB

Download
memory/5000-93-0x0000000002A70000-0x0000000002A77000-memory.dmp

Filesize
28KB

Download
memory/5112-107-0x00000202BEF40000-0x00000202BEF47000-memory.dmp

Filesize
28KB

Download