dridex | f3b0395084b9f2b7a4a01141e120cba2a6418b5e0115c49f117f92644ccef6a9

General

Target

1096fcd872148014eb60b91a9775c4ef_JaffaCakes118.dll
Size

989KB
MD5

1096fcd872148014eb60b91a9775c4ef
SHA1

fb906fa1446b0379d3560255c1c1e710b1f52255
SHA256

f3b0395084b9f2b7a4a01141e120cba2a6418b5e0115c49f117f92644ccef6a9
SHA512

011ac98ebfa19fd70c7766fee7ca22915d1a922792cc91a7c6b4088072eca36119e0b2145d35b2c85c8f8efe730f721162b96f8de04908b7fd92c6463f945e45
SSDEEP

24576:5VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:5V8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1204-5-0x0000000002D70000-0x0000000002D71000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

rekeywiz.exemsdtc.exerdpclip.exe

pid process

2448 rekeywiz.exe
2908 msdtc.exe
2748 rdpclip.exe
Loads dropped DLL 7 IoCs

Processes:

rekeywiz.exemsdtc.exerdpclip.exe

pid process

1204
2448 rekeywiz.exe
1204
2908 msdtc.exe
1204
2748 rdpclip.exe
1204

pid	process
2448	rekeywiz.exe
2908	msdtc.exe
2748	rdpclip.exe

pid	process
1204
2448	rekeywiz.exe
1204
2908	msdtc.exe
1204
2748	rdpclip.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yyeybzteybdsbj = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\TaskBar\\u4v7i\\msdtc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exerekeywiz.exemsdtc.exerdpclip.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rekeywiz.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msdtc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpclip.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1800	rundll32.exe
1800	rundll32.exe
1800	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 2460	1204	rekeywiz.exe
PID 1204 wrote to memory of 2460	1204	rekeywiz.exe
PID 1204 wrote to memory of 2460	1204	rekeywiz.exe
PID 1204 wrote to memory of 2448	1204	rekeywiz.exe
PID 1204 wrote to memory of 2448	1204	rekeywiz.exe
PID 1204 wrote to memory of 2448	1204	rekeywiz.exe
PID 1204 wrote to memory of 2972	1204	msdtc.exe
PID 1204 wrote to memory of 2972	1204	msdtc.exe
PID 1204 wrote to memory of 2972	1204	msdtc.exe
PID 1204 wrote to memory of 2908	1204	msdtc.exe
PID 1204 wrote to memory of 2908	1204	msdtc.exe
PID 1204 wrote to memory of 2908	1204	msdtc.exe
PID 1204 wrote to memory of 2736	1204	rdpclip.exe
PID 1204 wrote to memory of 2736	1204	rdpclip.exe
PID 1204 wrote to memory of 2736	1204	rdpclip.exe
PID 1204 wrote to memory of 2748	1204	rdpclip.exe
PID 1204 wrote to memory of 2748	1204	rdpclip.exe
PID 1204 wrote to memory of 2748	1204	rdpclip.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\1096fcd872148014eb60b91a9775c4ef_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1800

C:\Windows\system32\rekeywiz.exe
C:\Windows\system32\rekeywiz.exe
1⤵
PID:2460

C:\Users\Admin\AppData\Local\f8xkKM6s\rekeywiz.exe
C:\Users\Admin\AppData\Local\f8xkKM6s\rekeywiz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2448

C:\Windows\system32\msdtc.exe
C:\Windows\system32\msdtc.exe
1⤵
PID:2972

C:\Users\Admin\AppData\Local\26IKd\msdtc.exe
C:\Users\Admin\AppData\Local\26IKd\msdtc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2908

C:\Windows\system32\rdpclip.exe
C:\Windows\system32\rdpclip.exe
1⤵
PID:2736

C:\Users\Admin\AppData\Local\SmW\rdpclip.exe
C:\Users\Admin\AppData\Local\SmW\rdpclip.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\26IKd\VERSION.dll

Filesize
990KB

MD5
7d30b5d20f79803dfa6fb65266be1ffe

SHA1
ad3b4ebbfbe2139198b17f3813a9b7300cdf62a0

SHA256
ad787e930e5af071fa900dbaf8ee19f25cf50e4709dd8544bcdfbe15bb473d9a

SHA512
fb62e94d35ea13fe5fb495cff9bf4373bdc68104b67be34acd9c544ef3b378ec93eff6ff67e8fdc241e19dd3ed5179d80ec17b3d311e2c115b8ee3987217da81

Download Submit
C:\Users\Admin\AppData\Local\SmW\WTSAPI32.dll

Filesize
991KB

MD5
8b9d2a3c40e005cc6c2cdf8b21f4b4a7

SHA1
659a5dbd5f98eeaa807707fbd93acc84baea0061

SHA256
3dee39c8d927254a7db59d1faa5143bf667c5b013e0639553bf248e571821a74

SHA512
baa58772edcc288d2d89115e4313994ce93783f655257cdf7b668bd44ed080e6c2a7447ab64630c2e6f0663af947f9912ad24c9303dbfa2189f8c6d774c2761e

Download Submit
C:\Users\Admin\AppData\Local\f8xkKM6s\slc.dll

Filesize
991KB

MD5
e9dba3342799754c114936541daced15

SHA1
517cfca55c1e6af0e2414f202b2588cf6a7b1730

SHA256
698b8b896204bf7ed50e550d3f5cd1e32ff45db9ff073ee0930d24ed809acaed

SHA512
19dd54381618aa2f1fc919527546f99e08db6e1d711716500ed57f7419311dd661d32f64e84279bea8b2cd8fcacdb4b964a5c6c7d9cfb36f17438695585f2ec1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Omdqupblcei.lnk

Filesize
921B

MD5
ddb7353b7c350fbdc4fc50142b9510b6

SHA1
4c5cdc0c4902fcba8907111fdd53bc9ca7db6e8e

SHA256
d7e564f724791a7a891b49f46b69cbd3b31c5522a567f564175d3a5b4b950ec2

SHA512
4ac831025355693efa305e29625b0c4779bb333d20bc95c27a32a7313a5625a99de2c275b8776c13b0ade94896171a585037ce166770707c9cf2e86f0daf1fc7

Download Submit
\Users\Admin\AppData\Local\26IKd\msdtc.exe

Filesize
138KB

MD5
de0ece52236cfa3ed2dbfc03f28253a8

SHA1
84bbd2495c1809fcd19b535d41114e4fb101466c

SHA256
2fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3

SHA512
69386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3

Download Submit
\Users\Admin\AppData\Local\SmW\rdpclip.exe

Filesize
206KB

MD5
25d284eb2f12254c001afe9a82575a81

SHA1
cf131801fdd5ec92278f9e0ae62050e31c6670a5

SHA256
837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b

SHA512
7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

Download Submit
\Users\Admin\AppData\Local\f8xkKM6s\rekeywiz.exe

Filesize
67KB

MD5
767c75767b00ccfd41a547bb7b2adfff

SHA1
91890853a5476def402910e6507417d400c0d3cb

SHA256
bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395

SHA512
f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9

Download Submit
memory/1204-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-24-0x0000000002B50000-0x0000000002B57000-memory.dmp

Filesize
28KB

Download
memory/1204-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-25-0x0000000077491000-0x0000000077492000-memory.dmp

Filesize
4KB

Download
memory/1204-26-0x0000000077620000-0x0000000077622000-memory.dmp

Filesize
8KB

Download
memory/1204-4-0x0000000077286000-0x0000000077287000-memory.dmp

Filesize
4KB

Download
memory/1204-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-5-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/1204-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1204-63-0x0000000077286000-0x0000000077287000-memory.dmp

Filesize
4KB

Download
memory/1800-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1800-3-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1800-0-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2448-58-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2448-55-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/2448-52-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2748-92-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2748-95-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2908-74-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2908-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads