dridex | b6118f4e271962f340a7db112f550eacd9350522cf18c5cac9254b2529e87a76

General

Target

0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118.dll
Size

1.2MB
MD5

0cc4d29808e05957526c4893bffd6aeb
SHA1

fa50605e089ba9fea19c9fd354ed10f502d67e9c
SHA256

b6118f4e271962f340a7db112f550eacd9350522cf18c5cac9254b2529e87a76
SHA512

8ec75b8724a5bd3eccdd825c671f0f401a80cef33d745741fdb2b4bced8507ae71b12cf7a7e2e422a540f7c79320a51d3357deb748fc4d9e8ab036732d58a4b1
SSDEEP

24576:iVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:iV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3484-4-0x0000000001000000-0x0000000001001000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

psr.exeDmNotificationBroker.exeSystemPropertiesPerformance.exe

pid process

1052 psr.exe
2840 DmNotificationBroker.exe
652 SystemPropertiesPerformance.exe
Loads dropped DLL 3 IoCs

Processes:

psr.exeDmNotificationBroker.exeSystemPropertiesPerformance.exe

pid process

1052 psr.exe
2840 DmNotificationBroker.exe
652 SystemPropertiesPerformance.exe

pid	process
1052	psr.exe
2840	DmNotificationBroker.exe
652	SystemPropertiesPerformance.exe

pid	process
1052	psr.exe
2840	DmNotificationBroker.exe
652	SystemPropertiesPerformance.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-17203666-93769886-2545153620-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jrbkpoyx = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\Security\\tXf5\\DmNotificationBroker.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

psr.exeDmNotificationBroker.exeSystemPropertiesPerformance.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	psr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DmNotificationBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesPerformance.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
4420	rundll32.exe
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484
3484

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3484

pid	process
3484

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3484 wrote to memory of 4956	3484	psr.exe
PID 3484 wrote to memory of 4956	3484	psr.exe
PID 3484 wrote to memory of 1052	3484	psr.exe
PID 3484 wrote to memory of 1052	3484	psr.exe
PID 3484 wrote to memory of 3664	3484	DmNotificationBroker.exe
PID 3484 wrote to memory of 3664	3484	DmNotificationBroker.exe
PID 3484 wrote to memory of 2840	3484	DmNotificationBroker.exe
PID 3484 wrote to memory of 2840	3484	DmNotificationBroker.exe
PID 3484 wrote to memory of 1992	3484	SystemPropertiesPerformance.exe
PID 3484 wrote to memory of 1992	3484	SystemPropertiesPerformance.exe
PID 3484 wrote to memory of 652	3484	SystemPropertiesPerformance.exe
PID 3484 wrote to memory of 652	3484	SystemPropertiesPerformance.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0cc4d29808e05957526c4893bffd6aeb_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4420

C:\Windows\system32\psr.exe
C:\Windows\system32\psr.exe
1⤵
PID:4956

C:\Users\Admin\AppData\Local\qoySk2\psr.exe
C:\Users\Admin\AppData\Local\qoySk2\psr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1052

C:\Windows\system32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
1⤵
PID:3664

C:\Users\Admin\AppData\Local\HMs\DmNotificationBroker.exe
C:\Users\Admin\AppData\Local\HMs\DmNotificationBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2840

C:\Windows\system32\SystemPropertiesPerformance.exe
C:\Windows\system32\SystemPropertiesPerformance.exe
1⤵
PID:1992

C:\Users\Admin\AppData\Local\hkNmnqe\SystemPropertiesPerformance.exe
C:\Users\Admin\AppData\Local\hkNmnqe\SystemPropertiesPerformance.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\HMs\DUI70.dll

Filesize
1.5MB

MD5
fb2ac3c3d17769097696a2032de8f115

SHA1
8f4da0b55e0482cdebd9b306fe8c54d3343f124c

SHA256
968bea7086fd4ab96ee0c6dd5346ebea2450fd630dc2cf32f1cfa6d315ea9389

SHA512
878f0598c63b93e891a9c334816738916c968c71e285525fe98449235e43b266c91ef2bf158aef459dc8727eb754bf3e5ff28ce3dc5b6fe7269fbbfdf5255e60

Download Submit
C:\Users\Admin\AppData\Local\HMs\DmNotificationBroker.exe

Filesize
32KB

MD5
f0bdc20540d314a2aad951c7e2c88420

SHA1
4ab344595a4a81ab5f31ed96d72f217b4cee790b

SHA256
f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5

SHA512
cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

Download Submit
C:\Users\Admin\AppData\Local\hkNmnqe\SYSDM.CPL

Filesize
1.2MB

MD5
e7b460264a548d2ee12af855a5e09656

SHA1
78ccae7b552fcc25357246aaf6b20fa05015f18e

SHA256
2c80e720d6167724f7639cb019b33d11ed19e69bc1baacdb747b11bb6098fad2

SHA512
4d27a63e9c0ae3b04888988d82c126fa3e31599a7224a0cc6498b77f9d614b5003d2f5baddbb5f6bce4bbd38352b9847723f8daa9adc04e189e83e7b7e2c3fe2

Download Submit
C:\Users\Admin\AppData\Local\hkNmnqe\SystemPropertiesPerformance.exe

Filesize
82KB

MD5
e4fbf7cab8669c7c9cef92205d2f2ffc

SHA1
adbfa782b7998720fa85678cc85863b961975e28

SHA256
b266318d45a4245556a2e39b763f2f11eca780969105f6f103e53dd0a492bb30

SHA512
c5c62578d04133352d6cb7b018df96a7b55c18d6111ab8bf2bfe232a3315a63b07047fa5b0b88551d152085776c66169b47566242c8c4c5e0333c55adc64e1b6

Download Submit
C:\Users\Admin\AppData\Local\qoySk2\VERSION.dll

Filesize
1.2MB

MD5
c3ded30b20242b564f0ed6f2080e47d8

SHA1
3f39f4d76ededc7f5d5d3702bc3ffbe8a8fcbe2f

SHA256
494e26f4a409f8cd86de97ac21805dff1b52869faaebf02f332feac16d3ca08b

SHA512
6870bbb1ba8a7f19b5cee6dd9c3998a113cd56421e59b977ce683c0fccef40845e45fd5f1617ac69fa18cc0f70e97580cbc3857aaf679dc25adb7917c28264ad

Download Submit
C:\Users\Admin\AppData\Local\qoySk2\psr.exe

Filesize
232KB

MD5
ad53ead5379985081b7c3f1f357e545a

SHA1
6f5aa32c1d15fbf073558fadafd046d97b60184e

SHA256
4f0144f0e3e721b44babbf41b513942e4117f730546105480571f9c8fce56a1f

SHA512
433098bd74c34fbadfa447ef45cfa9dc076aef4cf7f2a0a6fe79d5e67f2504eebe8aa31fc1b7a4c5eeb20ede2c5485f75ad0fd77b4ecba3d68ca63313e6f6ea0

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Xzasfouulwckbw.lnk

Filesize
1KB

MD5
cff683572d024ca5a6a0f26cc3a95253

SHA1
bfb9c376e14ba7e10a3cd54a35a97e0a1feada0f

SHA256
a71656dc5586cae1692c84b00516ddcb2506cc5a7e66aa9b9c3c1d30d2c59a12

SHA512
d7fa8d3182097012daaf123b5504e51dadb13711e195fb21c57086c2c37e0155ff338c78fb0f667cb9e6f7d17b6fc0ad869af5d6c84c70b87341a2ff21e40ad5

Download Submit
memory/652-81-0x0000015D2C470000-0x0000015D2C477000-memory.dmp

Filesize
28KB

Download
memory/652-86-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/1052-50-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/1052-49-0x00000196DA6C0000-0x00000196DA6C7000-memory.dmp

Filesize
28KB

Download
memory/1052-46-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2840-66-0x000001A2CABF0000-0x000001A2CABF7000-memory.dmp

Filesize
28KB

Download
memory/2840-63-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/2840-69-0x0000000140000000-0x000000014018A000-memory.dmp

Filesize
1.5MB

Download
memory/3484-33-0x0000000000D50000-0x0000000000D57000-memory.dmp

Filesize
28KB

Download
memory/3484-13-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-6-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-4-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/3484-8-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-24-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-9-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-11-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-12-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-7-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-32-0x00007FFBD00BA000-0x00007FFBD00BB000-memory.dmp

Filesize
4KB

Download
memory/3484-10-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-34-0x00007FFBD13D0000-0x00007FFBD13E0000-memory.dmp

Filesize
64KB

Download
memory/3484-36-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-15-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3484-14-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/4420-0-0x0000018EB9060000-0x0000018EB9067000-memory.dmp

Filesize
28KB

Download
memory/4420-39-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/4420-1-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads