dridex | 578c92f464be0b7adac38b2599735835b874fb81bed5394ffa65d572facf4ed5

General

Target

6d29291670d613e73991f0ddb06f428c_JaffaCakes118.dll
Size

1.2MB
MD5

6d29291670d613e73991f0ddb06f428c
SHA1

19706380dcc284baf80bc7f38ed2b04db059d6f3
SHA256

578c92f464be0b7adac38b2599735835b874fb81bed5394ffa65d572facf4ed5
SHA512

292c88c08fce72512f0dc8efb961657356b8987310307338748bb4597cf8e828de60eaf8e6e730d2df7c294e593af5112402c571eff1579a18bf2393b2625d6b
SSDEEP

24576:xVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8/:xV8hf6STw1ZlQauvzSq01ICe6zvmc

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1368-5-0x00000000029E0000-0x00000000029E1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

FXSCOVER.exerdpinit.exeAdapterTroubleshooter.exe

pid process

2408 FXSCOVER.exe
2392 rdpinit.exe
2864 AdapterTroubleshooter.exe
Loads dropped DLL 7 IoCs

Processes:

FXSCOVER.exerdpinit.exeAdapterTroubleshooter.exe

pid process

1368
2408 FXSCOVER.exe
1368
2392 rdpinit.exe
1368
2864 AdapterTroubleshooter.exe
1368

pid	process
2408	FXSCOVER.exe
2392	rdpinit.exe
2864	AdapterTroubleshooter.exe

pid	process
1368
2408	FXSCOVER.exe
1368
2392	rdpinit.exe
1368
2864	AdapterTroubleshooter.exe
1368

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uxhwu = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\oLj8Dn\\rdpinit.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeFXSCOVER.exerdpinit.exeAdapterTroubleshooter.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FXSCOVER.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpinit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdapterTroubleshooter.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2884	rundll32.exe
2884	rundll32.exe
2884	rundll32.exe
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368
1368

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1368 wrote to memory of 2608	1368	FXSCOVER.exe
PID 1368 wrote to memory of 2608	1368	FXSCOVER.exe
PID 1368 wrote to memory of 2608	1368	FXSCOVER.exe
PID 1368 wrote to memory of 2408	1368	FXSCOVER.exe
PID 1368 wrote to memory of 2408	1368	FXSCOVER.exe
PID 1368 wrote to memory of 2408	1368	FXSCOVER.exe
PID 1368 wrote to memory of 696	1368	rdpinit.exe
PID 1368 wrote to memory of 696	1368	rdpinit.exe
PID 1368 wrote to memory of 696	1368	rdpinit.exe
PID 1368 wrote to memory of 2392	1368	rdpinit.exe
PID 1368 wrote to memory of 2392	1368	rdpinit.exe
PID 1368 wrote to memory of 2392	1368	rdpinit.exe
PID 1368 wrote to memory of 2820	1368	AdapterTroubleshooter.exe
PID 1368 wrote to memory of 2820	1368	AdapterTroubleshooter.exe
PID 1368 wrote to memory of 2820	1368	AdapterTroubleshooter.exe
PID 1368 wrote to memory of 2864	1368	AdapterTroubleshooter.exe
PID 1368 wrote to memory of 2864	1368	AdapterTroubleshooter.exe
PID 1368 wrote to memory of 2864	1368	AdapterTroubleshooter.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6d29291670d613e73991f0ddb06f428c_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2884

C:\Windows\system32\FXSCOVER.exe
C:\Windows\system32\FXSCOVER.exe
1⤵
PID:2608

C:\Users\Admin\AppData\Local\tiJwJwiAT\FXSCOVER.exe
C:\Users\Admin\AppData\Local\tiJwJwiAT\FXSCOVER.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2408

C:\Windows\system32\rdpinit.exe
C:\Windows\system32\rdpinit.exe
1⤵
PID:696

C:\Users\Admin\AppData\Local\fQACs\rdpinit.exe
C:\Users\Admin\AppData\Local\fQACs\rdpinit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2392

C:\Windows\system32\AdapterTroubleshooter.exe
C:\Windows\system32\AdapterTroubleshooter.exe
1⤵
PID:2820

C:\Users\Admin\AppData\Local\0xM0X\AdapterTroubleshooter.exe
C:\Users\Admin\AppData\Local\0xM0X\AdapterTroubleshooter.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2864

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0xM0X\d3d9.dll
Filesize
1.2MB

MD5
5986b0041f6101538a613ce736438618

SHA1
168fe318610fd5f35cf3b2d329b47c74f79f3d24

SHA256
6a586c7548fd391d801d6c8d6c5d33a3b4dda81a57db6a86e4637b25dcd77f36

SHA512
7ea5b432a22d6d9dd3027b566ab559d32e8ab4cab2060090828ee87d92a0a420d3d7635822ef073fe331609616ca2305facfbe8ba088c0c3137d70a4910f4630

Download Submit
C:\Users\Admin\AppData\Local\fQACs\WTSAPI32.dll
Filesize
1.2MB

MD5
d5b595a7cf94e92f4cd56e08c577cb96

SHA1
44479864e77bff76db804e66e4f937c51caf6ccd

SHA256
889337662a4820da714cd6874be58c65b0950bed51848076811b33b8d3f89720

SHA512
63a3404497b1cfa40c881701270535d059f863a224153704fa2c1c8ad7f86022252483e5f678fd7bedfebb1bee3a010cc18f079ce4d96db4781a629f9b6a5bf7

Download Submit
C:\Users\Admin\AppData\Local\tiJwJwiAT\MFC42u.dll
Filesize
1.3MB

MD5
1135585b5edf16f5cfa1e97888606ef0

SHA1
04bd6e28fd6284f170276d027182aec0903bc0dc

SHA256
ffaaf283d134fbb5189415981babe4be6fccf3814a7402ad701d9c20676e0458

SHA512
3c512743255e0a42c3fd06046f40350e05814ea8731ca67c251a6ce75b69e945d792ae750bb312410ee9cb016c9be37dd00f3d4560a9c4f166e7fee236603479

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dgsmy.lnk
Filesize
1KB

MD5
06b21eb56c1f87ddbb02103a8c2782f1

SHA1
65b04f1566440dd999f4a96a0fef5bbc42710ac9

SHA256
8eca2f7f683d7e3162251fef2512b19d227a9511fb92a683240abec234c8c7ee

SHA512
cbdf23581e482b8117d378c78593a6d711c3e645cfca7ee8592149a99579762741873809c1420557a52b582e8934e57c0b09668c881fc45f4d5eb73ae61543e9

Download Submit
\Users\Admin\AppData\Local\0xM0X\AdapterTroubleshooter.exe
Filesize
39KB

MD5
d4170c9ff5b2f85b0ce0246033d26919

SHA1
a76118e8775e16237cf00f2fb79718be0dc84db1

SHA256
d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da

SHA512
9c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608

Download Submit
\Users\Admin\AppData\Local\fQACs\rdpinit.exe
Filesize
174KB

MD5
664e12e0ea009cc98c2b578ff4983c62

SHA1
27b302c0108851ac6cc37e56590dd9074b09c3c9

SHA256
00bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332

SHA512
f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d

Download Submit
\Users\Admin\AppData\Local\tiJwJwiAT\FXSCOVER.exe
Filesize
261KB

MD5
5e2c61be8e093dbfe7fc37585be42869

SHA1
ed46cda4ece3ef187b0cf29ca843a6c6735af6c0

SHA256
3d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121

SHA512
90bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b

Download Submit
memory/1368-16-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-59-0x0000000077396000-0x0000000077397000-memory.dmp

Filesize
4KB

Download
memory/1368-17-0x0000000002200000-0x0000000002207000-memory.dmp

Filesize
28KB

Download
memory/1368-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-31-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-28-0x0000000077630000-0x0000000077632000-memory.dmp

Filesize
8KB

Download
memory/1368-27-0x00000000774A1000-0x00000000774A2000-memory.dmp

Filesize
4KB

Download
memory/1368-26-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-32-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-4-0x0000000077396000-0x0000000077397000-memory.dmp

Filesize
4KB

Download
memory/1368-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-5-0x00000000029E0000-0x00000000029E1000-memory.dmp

Filesize
4KB

Download
memory/1368-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1368-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2392-67-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2392-72-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2408-54-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/2408-49-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/2408-48-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2864-89-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2884-40-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2884-0-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2884-1-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads