dridex | 74cd2d4fa0961ef49cd9c03e280ba2b224d948f51f7c56d75592771ff1585cf6

General

Target

2a3eadb5b49e55c1d57f5fea6961bb2e_JaffaCakes118.dll
Size

993KB
MD5

2a3eadb5b49e55c1d57f5fea6961bb2e
SHA1

de9bedff2a89a1668e5eb6054170522f5a373ba8
SHA256

74cd2d4fa0961ef49cd9c03e280ba2b224d948f51f7c56d75592771ff1585cf6
SHA512

beb1d186d80c5edce4f9c4db3ce524dc69724ecea929912c4bbfa85adda23e93538bba6fd66473f425d3868817e795287476c33d726064f1da2fc407561c28fa
SSDEEP

24576:rVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:rV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3456-4-0x0000000003040000-0x0000000003041000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

mstsc.exeiexpress.exeSysResetErr.exe

pid process

4820 mstsc.exe
4980 iexpress.exe
2056 SysResetErr.exe
Loads dropped DLL 3 IoCs

Processes:

mstsc.exeiexpress.exeSysResetErr.exe

pid process

4820 mstsc.exe
4980 iexpress.exe
2056 SysResetErr.exe

pid	process
4820	mstsc.exe
4980	iexpress.exe
2056	SysResetErr.exe

pid	process
4820	mstsc.exe
4980	iexpress.exe
2056	SysResetErr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bhelxfhv = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\yNXd\\iexpress.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemstsc.exeiexpress.exeSysResetErr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstsc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	iexpress.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SysResetErr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
3052	rundll32.exe
3052	rundll32.exe
3052	rundll32.exe
3052	rundll32.exe
3052	rundll32.exe
3052	rundll32.exe
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456
3456

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3456

pid	process
3456

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3456 wrote to memory of 4356	3456	mstsc.exe
PID 3456 wrote to memory of 4356	3456	mstsc.exe
PID 3456 wrote to memory of 4820	3456	mstsc.exe
PID 3456 wrote to memory of 4820	3456	mstsc.exe
PID 3456 wrote to memory of 2320	3456	iexpress.exe
PID 3456 wrote to memory of 2320	3456	iexpress.exe
PID 3456 wrote to memory of 4980	3456	iexpress.exe
PID 3456 wrote to memory of 4980	3456	iexpress.exe
PID 3456 wrote to memory of 1952	3456	SysResetErr.exe
PID 3456 wrote to memory of 1952	3456	SysResetErr.exe
PID 3456 wrote to memory of 2056	3456	SysResetErr.exe
PID 3456 wrote to memory of 2056	3456	SysResetErr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2a3eadb5b49e55c1d57f5fea6961bb2e_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3052

C:\Windows\system32\mstsc.exe
C:\Windows\system32\mstsc.exe
1⤵
PID:4356

C:\Users\Admin\AppData\Local\2e3rl8\mstsc.exe
C:\Users\Admin\AppData\Local\2e3rl8\mstsc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4820

C:\Windows\system32\iexpress.exe
C:\Windows\system32\iexpress.exe
1⤵
PID:2320

C:\Users\Admin\AppData\Local\P5fg\iexpress.exe
C:\Users\Admin\AppData\Local\P5fg\iexpress.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4980

C:\Windows\system32\SysResetErr.exe
C:\Windows\system32\SysResetErr.exe
1⤵
PID:1952

C:\Users\Admin\AppData\Local\aPLaHgbq\SysResetErr.exe
C:\Users\Admin\AppData\Local\aPLaHgbq\SysResetErr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2056

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2e3rl8\Secur32.dll
Filesize
996KB

MD5
3b13cc60883eb8512e95506cdfbd726b

SHA1
66398d319d54df61e5a42ff5c2e7bbf98110f882

SHA256
fb8cdfb14fb2e1e648da15f28f8728208253744ef538ab36f5724086928d11f2

SHA512
f70e72622c7a7731bb09a1363bdd5003763c3a8c660fa9b68a1e07213f3b5c2460b9af8b2cb595a401b18ac7cfc88785cb474ff5ab89be01e5a5b72c963d71c7

Download Submit
C:\Users\Admin\AppData\Local\2e3rl8\mstsc.exe
Filesize
1.5MB

MD5
3a26640414cee37ff5b36154b1a0b261

SHA1
e0c28b5fdf53a202a7543b67bbc97214bad490ed

SHA256
1d1b6b2edac7ac6494c9eecda3afb804f679d7190f4d1a80929380e85743823f

SHA512
76fc70ead57ddacd3dbcec1a4772bd46924d30b30018a36b13052d2f7272cc86b63bf85d5e4ec04aac08630d4b2637ca6e7d35c08ce6b675d63ed011f7d95ba2

Download Submit
C:\Users\Admin\AppData\Local\P5fg\VERSION.dll
Filesize
994KB

MD5
e2920c555f27c86ef1d0daaa8a392fc2

SHA1
86cf5230814d7fd53df77349ecb2d15af62f3228

SHA256
a0ee8de475deca2d9783fdc9b8f116a99b6cbc7e16c94ecde853d8859ed2053b

SHA512
ca165a84cdd4778eec719de362c7059f9c6638adcec8ffc1f4eac660abf426c9fc4177ba115f93f26f7512335bbe88c6d932994f8a8e319b1fb2690233f38237

Download Submit
C:\Users\Admin\AppData\Local\P5fg\iexpress.exe
Filesize
166KB

MD5
17b93a43e25d821d01af40ba6babcc8c

SHA1
97c978d78056d995f751dfef1388d7cce4cc404a

SHA256
d070b79fa254c528babb73d607a7a8fd53db89795d751f42fc0a283b61a76fd3

SHA512
6b5743b37a3be8ae9ee2ab84e0749c32c60544298a7cce396470aa40bbd13f2e838d5d98159f21d500d20817c51ebce4b1d2f554e3e05f6c7fc97bc9d70ea391

Download Submit
C:\Users\Admin\AppData\Local\aPLaHgbq\DUI70.dll
Filesize
1.2MB

MD5
a1114d8861054765595db80e2a6e6590

SHA1
66c8559aac826ed285d1c581c1a48ab80811150b

SHA256
2b56abb5b689bd9f371db8753c7fd9d1d4daff07450c84c160d6ba31f1b7772a

SHA512
404afa0e23825524b3f65f9810e1f8d75d7b2c064d5f628e49c02c2a877722af18054e51099163ed16b39801e9fb0edb6ede86f95d9016ad12dd6fcdb90dbf73

Download Submit
C:\Users\Admin\AppData\Local\aPLaHgbq\SysResetErr.exe
Filesize
41KB

MD5
090c6f458d61b7ddbdcfa54e761b8b57

SHA1
c5a93e9d6eca4c3842156cc0262933b334113864

SHA256
a324e3ba7309164f215645a6db3e74ed35c7034cc07a011ebed2fa60fda4d9cd

SHA512
c9ef79397f3a843dcf2bcb5f761d90a4bdadb08e2ca85a35d8668cb13c308b275ed6aa2c8b9194a1f29964e0754ad05e89589025a0b670656386a8d448a1f542

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Oabtankaq.lnk
Filesize
1KB

MD5
6665c319f068d069a0d0f00e98ed4fa8

SHA1
1db3448f9e3bd1627017b951fab5a8c156689561

SHA256
3649b0072f824c1a355609138e0b16af093dd7bf8f0c26fe00d98bb839f556a9

SHA512
fc4d5dde31ef0e05243cac3b9abc90440f75242ed238f0abe7e8a15d6de0781e86d9f4b81bca0d68dfedb79565c41d906d8a711bee37fb1e0da1f84a9873467e

Download Submit
memory/2056-78-0x000002A74A350000-0x000002A74A357000-memory.dmp

Filesize
28KB

Download
memory/2056-79-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2056-84-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3052-37-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3052-0-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3052-3-0x000001D76AFE0000-0x000001D76AFE7000-memory.dmp

Filesize
28KB

Download
memory/3456-34-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-26-0x00007FF8EB27A000-0x00007FF8EB27B000-memory.dmp

Filesize
4KB

Download
memory/3456-8-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-10-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-11-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-13-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-4-0x0000000003040000-0x0000000003041000-memory.dmp

Filesize
4KB

Download
memory/3456-6-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-12-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-9-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-27-0x00000000011F0000-0x00000000011F7000-memory.dmp

Filesize
28KB

Download
memory/3456-22-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/3456-28-0x00007FF8ECC10000-0x00007FF8ECC20000-memory.dmp

Filesize
64KB

Download
memory/3456-7-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/4820-50-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/4820-44-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/4820-47-0x000002BCA5670000-0x000002BCA5677000-memory.dmp

Filesize
28KB

Download
memory/4980-67-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/4980-64-0x000002C29BA00000-0x000002C29BA07000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads