dridex | 765ef4bbf371d0cfc04fbc695677ddcb5a30c7048f459b64af10843fc6092bf9

General

Target

765ef4bbf371d0cfc04fbc695677ddcb5a30c7048f459b64af10843fc6092bf9.dll
Size

1.3MB
MD5

2ad40f29b98a6f42244a74f76ba97f20
SHA1

cce573df89865b4f2575c9b321632e93626812db
SHA256

765ef4bbf371d0cfc04fbc695677ddcb5a30c7048f459b64af10843fc6092bf9
SHA512

65e6df9ff642a6c1edc92fd4b6d1e05fb3a823f0e3ecf7f3d98fab7963ab843e77fd5b91c589708e371b82ce64cde1776770f6302851da103e356b931a164163
SSDEEP

12288:M38uea4w46+K1FZPfxyMs2SRXTajPomqkpyrJXy6mfvHELWUbxdewWRa7CkhkgjS:O8uea4w467D5/0ypyFYELW8xFZmMXJZ

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3420-3-0x0000000000C90000-0x0000000000C91000-memory.dmp	dridex_stager_shellcode

Dridex payload 9 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/2096-0-0x0000000140000000-0x000000014014F000-memory.dmp	dridex_payload
behavioral2/memory/3420-36-0x0000000140000000-0x000000014014F000-memory.dmp	dridex_payload
behavioral2/memory/2096-42-0x0000000140000000-0x000000014014F000-memory.dmp	dridex_payload
behavioral2/memory/3420-48-0x0000000140000000-0x000000014014F000-memory.dmp	dridex_payload
behavioral2/memory/5012-57-0x0000000140000000-0x0000000140150000-memory.dmp	dridex_payload
behavioral2/memory/5012-62-0x0000000140000000-0x0000000140150000-memory.dmp	dridex_payload
behavioral2/memory/3012-73-0x0000000140000000-0x0000000140151000-memory.dmp	dridex_payload
behavioral2/memory/3012-78-0x0000000140000000-0x0000000140151000-memory.dmp	dridex_payload
behavioral2/memory/1852-93-0x0000000140000000-0x0000000140151000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

sppsvc.exeRdpSa.exemspaint.exe

pid process

5012 sppsvc.exe
3012 RdpSa.exe
1852 mspaint.exe
Loads dropped DLL 3 IoCs

Processes:

sppsvc.exeRdpSa.exemspaint.exe

pid process

5012 sppsvc.exe
3012 RdpSa.exe
1852 mspaint.exe

pid	process
5012	sppsvc.exe
3012	RdpSa.exe
1852	mspaint.exe

pid	process
5012	sppsvc.exe
3012	RdpSa.exe
1852	mspaint.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jrbkpoyx = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\IMPLIC~1\\yFQp\\RdpSa.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exesppsvc.exeRdpSa.exemspaint.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sppsvc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RdpSa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mspaint.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2096	rundll32.exe
2096	rundll32.exe
2096	rundll32.exe
2096	rundll32.exe
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420
3420

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

pid process

3420
3420
3420
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

pid process

3420
3420
3420

pid	process
3420
3420
3420

pid	process
3420
3420
3420

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

description	pid	target process
PID 3420 wrote to memory of 5012	3420	sppsvc.exe
PID 3420 wrote to memory of 5012	3420	sppsvc.exe
PID 3420 wrote to memory of 1864	3420	RdpSa.exe
PID 3420 wrote to memory of 1864	3420	RdpSa.exe
PID 3420 wrote to memory of 3012	3420	RdpSa.exe
PID 3420 wrote to memory of 3012	3420	RdpSa.exe
PID 3420 wrote to memory of 4924	3420	mspaint.exe
PID 3420 wrote to memory of 4924	3420	mspaint.exe
PID 3420 wrote to memory of 1852	3420	mspaint.exe
PID 3420 wrote to memory of 1852	3420	mspaint.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\765ef4bbf371d0cfc04fbc695677ddcb5a30c7048f459b64af10843fc6092bf9.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2096

C:\Windows\system32\sppsvc.exe
C:\Windows\system32\sppsvc.exe
1⤵
PID:4472

C:\Users\Admin\AppData\Local\DrUacR\sppsvc.exe
C:\Users\Admin\AppData\Local\DrUacR\sppsvc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5012

C:\Windows\system32\RdpSa.exe
C:\Windows\system32\RdpSa.exe
1⤵
PID:1864

C:\Users\Admin\AppData\Local\VVyEtl4u\RdpSa.exe
C:\Users\Admin\AppData\Local\VVyEtl4u\RdpSa.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3012

C:\Windows\system32\mspaint.exe
C:\Windows\system32\mspaint.exe
1⤵
PID:4924

C:\Users\Admin\AppData\Local\P7rPgNGS\mspaint.exe
C:\Users\Admin\AppData\Local\P7rPgNGS\mspaint.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1852

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DrUacR\XmlLite.dll
Filesize
1.3MB

MD5
8359697a3553fbbf55bd963b3580a2ae

SHA1
f1da5e40b64eff5359faf53d206552f85ed4aed8

SHA256
44b5f27d98bb94b343f96831ce908d112db2783d8b03a0befa8fd27c2975c1e8

SHA512
643474fdfee450c4a7fff1fff3da4340ee291c59a723ef8a0796c066534392ee969d2ee97169efb961164aba61f235b14373982acd9b06b3cf8e66a7a7e3708d

Download Submit
C:\Users\Admin\AppData\Local\DrUacR\sppsvc.exe
Filesize
4.4MB

MD5
ec6cef0a81f167668e18fa32f1606fce

SHA1
6d56837a388ae5573a38a439cee16e6dde5b4de8

SHA256
82c59a2f606ebf1a8a0de16be150600ac63ad8351c6bf3952c27a70257cb70f8

SHA512
f40b37675329ca7875d958b4b0019082548a563ada217c7431c2ca5c7f93957b242f095f7f04bcdd6240b97ea99e89bfe3a003f97c43366d00a93768fef7b4c5

Download Submit
C:\Users\Admin\AppData\Local\P7rPgNGS\WINMM.dll
Filesize
1.3MB

MD5
610b9ea27b9c47273459efa6c45fc00f

SHA1
35a064b13f6665bf53b70c871a1829c997a9dfcd

SHA256
935e7301a0a1d8fc870ddcf3c8e3663b54fd31c103032409c6831872cca792ef

SHA512
bf3ddf741e1e1fe4e03e194dcc932745db34800d44b2fb4760fd38e3ede5fc5222431ff4b9e5b53b531be0d4d9d77feec3ad7e2384d1493dc907cc8aa6bcfd29

Download Submit
C:\Users\Admin\AppData\Local\P7rPgNGS\mspaint.exe
Filesize
965KB

MD5
f221a4ccafec690101c59f726c95b646

SHA1
2098e4b62eaab213cbee73ba40fe4f1b8901a782

SHA256
94aa32a2c9c1d2db78318d9c68262c2f834abe26b6e9a661700324b55fdd5709

SHA512
8e3f4e4f68565ef09f5e762d6bb41b160711bbacac9dfcbe33edea9885fd042e6ce9a248bfcc62f9cffdb8e6bbe1b04c89bd41fcd9a373a5c8bc7bbff96dceaf

Download Submit
C:\Users\Admin\AppData\Local\VVyEtl4u\RdpSa.exe
Filesize
56KB

MD5
5992f5b5d0b296b83877da15b54dd1b4

SHA1
0d87be8d4b7aeada4b55d1d05c0539df892f8f82

SHA256
32f60eabe54c4d0cd0f0ec29f48f55ca1ad097bf35097247b186fd70426f847c

SHA512
4f6da913af530301da1d0638aa2635ada446ebee6e27b5059db5c2b7fe439162ac3b1a595ecf4163a093890df9ac94d9085a53d8c991e48703f9d2691326e7e6

Download Submit
C:\Users\Admin\AppData\Local\VVyEtl4u\WINSTA.dll
Filesize
1.3MB

MD5
509b9e128b01496af261e3784e2345d0

SHA1
ef11b2a29fd3d3d80ba143425209ca91aae7cec9

SHA256
5c2ea594b37708a46e2f9e7d710cd8361d083b6051ac353a8b12d54ec4b0cbd4

SHA512
a8f23f922830d63dbf3d4d4dab2b5fc342822a5da7cd2a8c21fa80b2ab6105c5354cef08d805bbd828d4337491eb3bc3be48b3d31a6bd5402b03f06ee636b926

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Xzasfouulwckbw.lnk
Filesize
1KB

MD5
9b13e82283ef5d0f402461c830a1e682

SHA1
de9fdbdf94ada3242c67d49de94d14a4e64d1687

SHA256
f2f47bef3fbc8a99f63e51a904c2971e19464b2848c70d226f83748806cae73f

SHA512
60749022c9c5fd819c50c81746f5f18952399815c58d76e1985da897bcc6ba0bfcecbf70ec0c0707258ed4ca327dc42390193cf2b230c51dde309bbe0237bf44

Download Submit
memory/1852-93-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/1852-90-0x0000013CE7880000-0x0000013CE7887000-memory.dmp

Filesize
28KB

Download
memory/2096-0-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/2096-42-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/2096-2-0x00000223F28D0000-0x00000223F28D7000-memory.dmp

Filesize
28KB

Download
memory/3012-73-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/3012-75-0x0000017ED3B60000-0x0000017ED3B67000-memory.dmp

Filesize
28KB

Download
memory/3012-78-0x0000000140000000-0x0000000140151000-memory.dmp

Filesize
1.3MB

Download
memory/3420-35-0x0000000000C50000-0x0000000000C57000-memory.dmp

Filesize
28KB

Download
memory/3420-23-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-19-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-20-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-17-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-15-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-14-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-13-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-12-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-11-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-10-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-9-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-8-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-7-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-6-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-22-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-48-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-24-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-25-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-3-0x0000000000C90000-0x0000000000C91000-memory.dmp

Filesize
4KB

Download
memory/3420-5-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-21-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-34-0x00007FF97282A000-0x00007FF97282B000-memory.dmp

Filesize
4KB

Download
memory/3420-36-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-37-0x00007FF973760000-0x00007FF973770000-memory.dmp

Filesize
64KB

Download
memory/3420-38-0x00007FF973750000-0x00007FF973760000-memory.dmp

Filesize
64KB

Download
memory/3420-26-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-16-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/3420-18-0x0000000140000000-0x000000014014F000-memory.dmp

Filesize
1.3MB

Download
memory/5012-62-0x0000000140000000-0x0000000140150000-memory.dmp

Filesize
1.3MB

Download
memory/5012-59-0x000002CCBA2A0000-0x000002CCBA2A7000-memory.dmp

Filesize
28KB

Download
memory/5012-57-0x0000000140000000-0x0000000140150000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads