dridex | 445accea40bee73a661f478c9bfd5c9129b49ad86971a3cb25dae06f1a572a14

General

Target

5ce626cc979bced4df80a332aa794800_NEIKI.dll
Size

1.8MB
MD5

5ce626cc979bced4df80a332aa794800
SHA1

31f289af6916a9e20780333e928710df52da459d
SHA256

445accea40bee73a661f478c9bfd5c9129b49ad86971a3cb25dae06f1a572a14
SHA512

40473c862c21c3cd44aabdc8ee4b232be2ffb20973049f7deebe792816d43b7e27788d89197a50ff5a9d5f282374a1fd830c0f8f2fdf6663864c853b06cd5090
SSDEEP

12288:m38uea4w46+K1FZPfxyMs2SRXTajPomqkpyrJXy6mfvHELWUbxdewWRa7Ckhkgjj:M8uea4w467D5/0ypyFYELW8xFZmMXJZ

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3324-3-0x0000000008510000-0x0000000008511000-memory.dmp	dridex_stager_shellcode

Dridex payload 8 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/1484-0-0x0000000140000000-0x00000001401D9000-memory.dmp	dridex_payload
behavioral2/memory/3324-48-0x0000000140000000-0x00000001401D9000-memory.dmp	dridex_payload
behavioral2/memory/3324-37-0x0000000140000000-0x00000001401D9000-memory.dmp	dridex_payload
behavioral2/memory/1484-51-0x0000000140000000-0x00000001401D9000-memory.dmp	dridex_payload
behavioral2/memory/4344-58-0x0000000140000000-0x00000001401DA000-memory.dmp	dridex_payload
behavioral2/memory/4344-63-0x0000000140000000-0x00000001401DA000-memory.dmp	dridex_payload
behavioral2/memory/4084-79-0x0000000140000000-0x00000001401DA000-memory.dmp	dridex_payload
behavioral2/memory/2216-95-0x0000000140000000-0x00000001401DA000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

slui.exewextract.exesethc.exe

pid process

4344 slui.exe
4084 wextract.exe
2216 sethc.exe
Loads dropped DLL 3 IoCs

Processes:

slui.exewextract.exesethc.exe

pid process

4344 slui.exe
4084 wextract.exe
2216 sethc.exe

pid	process
4344	slui.exe
4084	wextract.exe
2216	sethc.exe

pid	process
4344	slui.exe
4084	wextract.exe
2216	sethc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2860750803-256193626-1801997576-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ramyketlbwvbqf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\OneNote\\16.0\\MeoePkQM6j\\wextract.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeslui.exewextract.exesethc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wextract.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sethc.exe

Modifies registry class 1 IoCs

Processes:

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1484	rundll32.exe
1484	rundll32.exe
1484	rundll32.exe
1484	rundll32.exe
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324
3324

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

description	pid	process
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324
Token: SeShutdownPrivilege	3324
Token: SeCreatePagefilePrivilege	3324

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3324
3324
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3324

pid	process
3324
3324

pid	process
3324

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3324 wrote to memory of 2080	3324	slui.exe
PID 3324 wrote to memory of 2080	3324	slui.exe
PID 3324 wrote to memory of 4344	3324	slui.exe
PID 3324 wrote to memory of 4344	3324	slui.exe
PID 3324 wrote to memory of 5224	3324	wextract.exe
PID 3324 wrote to memory of 5224	3324	wextract.exe
PID 3324 wrote to memory of 4084	3324	wextract.exe
PID 3324 wrote to memory of 4084	3324	wextract.exe
PID 3324 wrote to memory of 1900	3324	sethc.exe
PID 3324 wrote to memory of 1900	3324	sethc.exe
PID 3324 wrote to memory of 2216	3324	sethc.exe
PID 3324 wrote to memory of 2216	3324	sethc.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5ce626cc979bced4df80a332aa794800_NEIKI.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1484

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:2080

C:\Users\Admin\AppData\Local\34fLLx\slui.exe
C:\Users\Admin\AppData\Local\34fLLx\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4344

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:5224

C:\Users\Admin\AppData\Local\BvhF9Ov\wextract.exe
C:\Users\Admin\AppData\Local\BvhF9Ov\wextract.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4084

C:\Windows\system32\sethc.exe
C:\Windows\system32\sethc.exe
1⤵
PID:1900

C:\Users\Admin\AppData\Local\Y9RLgl\sethc.exe
C:\Users\Admin\AppData\Local\Y9RLgl\sethc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2216

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\34fLLx\SLC.dll
Filesize
1.9MB

MD5
23366eb85df1dc3f6d028ae02af7a579

SHA1
774f717f581bcd9f640e8d5f938133cdc339bbee

SHA256
72f7f63b4844cae7e8b29c2610eb780f3afa3e2fc86df33f6832a398c03c2758

SHA512
51070cc7340c787e989bf6ad41f6c48f5795881dd76098f25ba465c9cbdf3fd1757133ace5e7bfc68e44c5d00a1de534c20ce108930f6da612e77e55f1bea4c2

Download Submit
C:\Users\Admin\AppData\Local\34fLLx\slui.exe
Filesize
534KB

MD5
eb725ea35a13dc18eac46aa81e7f2841

SHA1
c0b3304c970324952e18c4a51073e3bdec73440b

SHA256
25e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff

SHA512
39192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26

Download Submit
C:\Users\Admin\AppData\Local\BvhF9Ov\VERSION.dll
Filesize
1.9MB

MD5
ade97477402549bbe72b24d53f7ac331

SHA1
37542a2cf2882c7153c0fe6e98ff7df7043be348

SHA256
039d73df02053334c88335e2bc7ac613ed1ea545cc341dd63b88e55c0e2ef787

SHA512
0c1eeab82dea4542a2baf4ee881c63c300fc265fa7b103a41f0d4e8c376b5ac753c0da516ece8239c7e46747f70b2eb41cad064eb67f0a59c81627a7c4da861e

Download Submit
C:\Users\Admin\AppData\Local\BvhF9Ov\wextract.exe
Filesize
143KB

MD5
56e501e3e49cfde55eb1caabe6913e45

SHA1
ab2399cbf17dbee7b302bea49e40d4cee7caea76

SHA256
fbb6dc62abeeb222b49a63f43dc6eea96f3d7e9a8da55381c15d57a5d099f3e0

SHA512
2b536e86cbd8ab026529ba2c72c0fda97e9b6f0bc4fd96777024155852670cb41d17937cde372a44cdbad3e53b8cd3ef1a4a3ee9b34dfb3c2069822095f7a172

Download Submit
C:\Users\Admin\AppData\Local\Y9RLgl\WTSAPI32.dll
Filesize
1.9MB

MD5
2eee7d9b52b6f4b0b9fc072aa5a40dc9

SHA1
92c71761d808371bfdd962be063363f971e992d7

SHA256
8d1ae730edcfcc51c42d4b7859ad9b122c4c0fb267ae9554b3c68a6e2052d761

SHA512
a19c26f95a422f2203abc17a47c22092e7dfdda6662c71281b055bedb06d3f0ab0bafdc4bcc7645bffd51adb5c55f57bb4621c162a668ea4bcbf08c4f306a7e7

Download Submit
C:\Users\Admin\AppData\Local\Y9RLgl\sethc.exe
Filesize
104KB

MD5
8ba3a9702a3f1799431cad6a290223a6

SHA1
9c7dc9b6830297c8f759d1f46c8b36664e26c031

SHA256
615b2f2d7e3fce340839a9b54bdc3445eb2333d0fafee477d6113379e90935b8

SHA512
680c216d54f4fd2a14f0398e4461c8340ac15acdca75c36a42083625e1081d5e7d262c4c12296b6f21ba2f593f92816edf1c9a0cf4cbee23588e590713b87746

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ehesgegqlj.lnk
Filesize
1KB

MD5
015640e0ae74f31a3924e802c0f5db08

SHA1
8d4f16cbf5f79b0029bea320da024ae0fed18a1f

SHA256
984e31b0c3133cb0aa7876bb815320af8dde6c6ebe674278922e1a1555acd454

SHA512
defb5ab25af5319a43e9e7caecec6d2e390b43587bc9fb7072c6fb8b07331154fa4f4cc794859c6f395bea866d927c87d560a71a8724b13815c9f3e77c215038

Download Submit
memory/1484-51-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/1484-1-0x0000022A955C0000-0x0000022A955C7000-memory.dmp

Filesize
28KB

Download
memory/1484-0-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/2216-95-0x0000000140000000-0x00000001401DA000-memory.dmp

Filesize
1.9MB

Download
memory/2216-92-0x0000024D45140000-0x0000024D45147000-memory.dmp

Filesize
28KB

Download
memory/3324-37-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-7-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-25-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-24-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-22-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-20-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-18-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-17-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-14-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-13-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-12-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-11-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-10-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-23-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-21-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-8-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-19-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-26-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-15-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-9-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-27-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-38-0x00007FFA2EA00000-0x00007FFA2EA10000-memory.dmp

Filesize
64KB

Download
memory/3324-48-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-5-0x00007FFA2E77A000-0x00007FFA2E77B000-memory.dmp

Filesize
4KB

Download
memory/3324-3-0x0000000008510000-0x0000000008511000-memory.dmp

Filesize
4KB

Download
memory/3324-6-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-39-0x00007FFA2E9F0000-0x00007FFA2EA00000-memory.dmp

Filesize
64KB

Download
memory/3324-36-0x00000000084F0000-0x00000000084F7000-memory.dmp

Filesize
28KB

Download
memory/3324-16-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/3324-28-0x0000000140000000-0x00000001401D9000-memory.dmp

Filesize
1.8MB

Download
memory/4084-79-0x0000000140000000-0x00000001401DA000-memory.dmp

Filesize
1.9MB

Download
memory/4084-76-0x00000179B3900000-0x00000179B3907000-memory.dmp

Filesize
28KB

Download
memory/4344-63-0x0000000140000000-0x00000001401DA000-memory.dmp

Filesize
1.9MB

Download
memory/4344-58-0x0000000140000000-0x00000001401DA000-memory.dmp

Filesize
1.9MB

Download
memory/4344-60-0x0000028FA0B30000-0x0000028FA0B37000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads