dridex | 3fa05daafcd5984a5c5e340e6b78138c8f3527eb35ba647f79c16b34a48eb9fd

General

Target

2247a1e7c2f18b255f28ef00d2d930f8_JaffaCakes118.dll
Size

989KB
MD5

2247a1e7c2f18b255f28ef00d2d930f8
SHA1

bd852bcc11266bd28c494b6bf036e5710d90c2f2
SHA256

3fa05daafcd5984a5c5e340e6b78138c8f3527eb35ba647f79c16b34a48eb9fd
SHA512

f4031a1236b6ced52fabe05934a4359fb0d352715d80f02c864cc3870c1a4917a3137eee7fba5ef5c93b8d7e11c4bd25c3d6225e9ea8589061c48f9d7ca7e6aa
SSDEEP

24576:JVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:JV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1192-5-0x0000000002D90000-0x0000000002D91000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

msra.exeMpSigStub.exeSystemPropertiesDataExecutionPrevention.exe

pid process

2460 msra.exe
2648 MpSigStub.exe
1500 SystemPropertiesDataExecutionPrevention.exe
Loads dropped DLL 7 IoCs

Processes:

msra.exeMpSigStub.exeSystemPropertiesDataExecutionPrevention.exe

pid process

1192
2460 msra.exe
1192
2648 MpSigStub.exe
1192
1500 SystemPropertiesDataExecutionPrevention.exe
1192

pid	process
2460	msra.exe
2648	MpSigStub.exe
1500	SystemPropertiesDataExecutionPrevention.exe

pid	process
1192
2460	msra.exe
1192
2648	MpSigStub.exe
1192
1500	SystemPropertiesDataExecutionPrevention.exe
1192

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ybhspkdtbke = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ACCESS~1\\SYSTEM~1\\KIJECB~1\\MPSIGS~1.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SystemPropertiesDataExecutionPrevention.exerundll32.exemsra.exeMpSigStub.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesDataExecutionPrevention.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msra.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MpSigStub.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192
1192

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1192 wrote to memory of 2412	1192	msra.exe
PID 1192 wrote to memory of 2412	1192	msra.exe
PID 1192 wrote to memory of 2412	1192	msra.exe
PID 1192 wrote to memory of 2460	1192	msra.exe
PID 1192 wrote to memory of 2460	1192	msra.exe
PID 1192 wrote to memory of 2460	1192	msra.exe
PID 1192 wrote to memory of 2456	1192	MpSigStub.exe
PID 1192 wrote to memory of 2456	1192	MpSigStub.exe
PID 1192 wrote to memory of 2456	1192	MpSigStub.exe
PID 1192 wrote to memory of 2648	1192	MpSigStub.exe
PID 1192 wrote to memory of 2648	1192	MpSigStub.exe
PID 1192 wrote to memory of 2648	1192	MpSigStub.exe
PID 1192 wrote to memory of 308	1192	SystemPropertiesDataExecutionPrevention.exe
PID 1192 wrote to memory of 308	1192	SystemPropertiesDataExecutionPrevention.exe
PID 1192 wrote to memory of 308	1192	SystemPropertiesDataExecutionPrevention.exe
PID 1192 wrote to memory of 1500	1192	SystemPropertiesDataExecutionPrevention.exe
PID 1192 wrote to memory of 1500	1192	SystemPropertiesDataExecutionPrevention.exe
PID 1192 wrote to memory of 1500	1192	SystemPropertiesDataExecutionPrevention.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2247a1e7c2f18b255f28ef00d2d930f8_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\system32\msra.exe
C:\Windows\system32\msra.exe
1⤵
PID:2412

C:\Users\Admin\AppData\Local\XIPC0TWLk\msra.exe
C:\Users\Admin\AppData\Local\XIPC0TWLk\msra.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2460

C:\Windows\system32\MpSigStub.exe
C:\Windows\system32\MpSigStub.exe
1⤵
PID:2456

C:\Users\Admin\AppData\Local\bSMo\MpSigStub.exe
C:\Users\Admin\AppData\Local\bSMo\MpSigStub.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2648

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
1⤵
PID:308

C:\Users\Admin\AppData\Local\3EXnOm\SystemPropertiesDataExecutionPrevention.exe
C:\Users\Admin\AppData\Local\3EXnOm\SystemPropertiesDataExecutionPrevention.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1500

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\XIPC0TWLk\NDFAPI.DLL
Filesize
990KB

MD5
33532b24e53394b54d98c767bcf4b80c

SHA1
384098cf0731dab5b23f53f2ffe22f80086be6a7

SHA256
a48d9a3f3c7854b5164b29f8dbe9f64f497a40e7c6578327290cc711ecb35fb0

SHA512
328e6a182343881302bc4feb5c404bb28d1443fabd3eebfdcf1aff2de08d08c3b97f34bddfa8c8cdf9817ae33d6b1bdefbe5ad6ebb0225b5821f77dfc25f3690

Download Submit
C:\Users\Admin\AppData\Local\bSMo\MpSigStub.exe
Filesize
264KB

MD5
2e6bd16aa62e5e95c7b256b10d637f8f

SHA1
350be084477b1fe581af83ca79eb58d4defe260f

SHA256
d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3

SHA512
1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

Download Submit
C:\Users\Admin\AppData\Local\bSMo\VERSION.dll
Filesize
990KB

MD5
d56425feb272ba6f55c3ba89d89e5473

SHA1
5ad2226478fc3e1164f3c97c72e64011f54da596

SHA256
de09bd8d395b784eafd9cf6e379eada33df57dc34ccee1b65b007465235da5c2

SHA512
379b3c40199620133897e0ed1b427783c2a5010324b90115cdbbb7de20289cb07183eca03047079576ef565bf531e93b1c6b0dea74f217afa951583c86384447

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tkjddllshxzvy.lnk
Filesize
1KB

MD5
de0a4db25c01ab5882ee5f11e195455f

SHA1
b43c5187dad9c02e17630c37b3f90cd91afddd51

SHA256
3b9cf20c6efd3ee579e769e64e64e5d38c6c9f9ad777ec11ba277b1d922486af

SHA512
5512fcb15c032f61f1eda1f2a4ad01117ab837da9f5a3e85c556fc933d96f0832839b3cef41664522426a455706f8d6441dd6733995fa546f6b5aed5727c7dc9

Download Submit
\Users\Admin\AppData\Local\3EXnOm\SYSDM.CPL
Filesize
990KB

MD5
5728d19a75fc9046495c980c520496fb

SHA1
87bb23e20f6d5d2b619679ad729245c067a9fee7

SHA256
76c3a8b92c6e075922601be12ed8bac58fe591fca4d7c2f2bc27faed79323f37

SHA512
fcc9625a737b0dd4e91d16360070368c35b54b83d90ad40dfdc1599bbd0a576c5c7537aa5ff7e45c9bda8aa4a46fa4f1eb902f65dbd9c7679ca95085dfe1a38f

Download Submit
\Users\Admin\AppData\Local\3EXnOm\SystemPropertiesDataExecutionPrevention.exe
Filesize
80KB

MD5
e43ff7785fac643093b3b16a9300e133

SHA1
a30688e84c0b0a22669148fe87680b34fcca2fba

SHA256
c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b

SHA512
61260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a

Download Submit
\Users\Admin\AppData\Local\XIPC0TWLk\msra.exe
Filesize
636KB

MD5
e79df53bad587e24b3cf965a5746c7b6

SHA1
87a97ec159a3fc1db211f3c2c62e4d60810e7a70

SHA256
4e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d

SHA512
9a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb

Download Submit
memory/1192-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-24-0x0000000002D70000-0x0000000002D77000-memory.dmp

Filesize
28KB

Download
memory/1192-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-25-0x0000000077C31000-0x0000000077C32000-memory.dmp

Filesize
4KB

Download
memory/1192-26-0x0000000077DC0000-0x0000000077DC2000-memory.dmp

Filesize
8KB

Download
memory/1192-4-0x0000000077B26000-0x0000000077B27000-memory.dmp

Filesize
4KB

Download
memory/1192-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-5-0x0000000002D90000-0x0000000002D91000-memory.dmp

Filesize
4KB

Download
memory/1192-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1192-63-0x0000000077B26000-0x0000000077B27000-memory.dmp

Filesize
4KB

Download
memory/1500-92-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/1500-95-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2256-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2256-0-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2256-3-0x00000000002B0000-0x00000000002B7000-memory.dmp

Filesize
28KB

Download
memory/2460-58-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2460-55-0x0000000000290000-0x0000000000297000-memory.dmp

Filesize
28KB

Download
memory/2460-52-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2648-71-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2648-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads