dridex | 976e368f1c88cbaa179d651e604ec02dc14db5548b5051c9a70de81b1c41a600

General

Target

805cfbdf86f0b96d764ec4d94cf2360c_JaffaCakes118.dll
Size

987KB
MD5

805cfbdf86f0b96d764ec4d94cf2360c
SHA1

135e15ca1b80483e83e016dbcb11ba64dd289b7e
SHA256

976e368f1c88cbaa179d651e604ec02dc14db5548b5051c9a70de81b1c41a600
SHA512

992432c661273be9c0f7ad6e9568f5b892e8d6626c99347b31bb39f02e4acfe1bac47d63a7e20e8459e76840c26187c385bb6e1c88f350146e2bff6d1d3c6045
SSDEEP

24576:4VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:4V8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1144-5-0x0000000002DD0000-0x0000000002DD1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

dpnsvr.exerekeywiz.exenotepad.exe

pid process

2652 dpnsvr.exe
1604 rekeywiz.exe
544 notepad.exe
Loads dropped DLL 7 IoCs

Processes:

dpnsvr.exerekeywiz.exenotepad.exe

pid process

1144
2652 dpnsvr.exe
1144
1604 rekeywiz.exe
1144
544 notepad.exe
1144

pid	process
2652	dpnsvr.exe
1604	rekeywiz.exe
544	notepad.exe

pid	process
1144
2652	dpnsvr.exe
1144
1604	rekeywiz.exe
1144
544	notepad.exe
1144

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ybhspkdtbke = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\Ka1wz\\rekeywiz.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exedpnsvr.exerekeywiz.exenotepad.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dpnsvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rekeywiz.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	notepad.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1948	rundll32.exe
1948	rundll32.exe
1948	rundll32.exe
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144
1144

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1144 wrote to memory of 2548	1144	dpnsvr.exe
PID 1144 wrote to memory of 2548	1144	dpnsvr.exe
PID 1144 wrote to memory of 2548	1144	dpnsvr.exe
PID 1144 wrote to memory of 2652	1144	dpnsvr.exe
PID 1144 wrote to memory of 2652	1144	dpnsvr.exe
PID 1144 wrote to memory of 2652	1144	dpnsvr.exe
PID 1144 wrote to memory of 1716	1144	rekeywiz.exe
PID 1144 wrote to memory of 1716	1144	rekeywiz.exe
PID 1144 wrote to memory of 1716	1144	rekeywiz.exe
PID 1144 wrote to memory of 1604	1144	rekeywiz.exe
PID 1144 wrote to memory of 1604	1144	rekeywiz.exe
PID 1144 wrote to memory of 1604	1144	rekeywiz.exe
PID 1144 wrote to memory of 2624	1144	notepad.exe
PID 1144 wrote to memory of 2624	1144	notepad.exe
PID 1144 wrote to memory of 2624	1144	notepad.exe
PID 1144 wrote to memory of 544	1144	notepad.exe
PID 1144 wrote to memory of 544	1144	notepad.exe
PID 1144 wrote to memory of 544	1144	notepad.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\805cfbdf86f0b96d764ec4d94cf2360c_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1948

C:\Windows\system32\dpnsvr.exe
C:\Windows\system32\dpnsvr.exe
1⤵
PID:2548

C:\Users\Admin\AppData\Local\Iee5B\dpnsvr.exe
C:\Users\Admin\AppData\Local\Iee5B\dpnsvr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2652

C:\Windows\system32\rekeywiz.exe
C:\Windows\system32\rekeywiz.exe
1⤵
PID:1716

C:\Users\Admin\AppData\Local\kGmJ9H\rekeywiz.exe
C:\Users\Admin\AppData\Local\kGmJ9H\rekeywiz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1604

C:\Windows\system32\notepad.exe
C:\Windows\system32\notepad.exe
1⤵
PID:2624

C:\Users\Admin\AppData\Local\rkoy5cRxb\notepad.exe
C:\Users\Admin\AppData\Local\rkoy5cRxb\notepad.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:544

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Iee5B\WINMM.dll
Filesize
992KB

MD5
c148c2f59b1ade826509c57ad1cd65c6

SHA1
cf7ec96df02eb1f8ec23e60a184203d3876d7ce6

SHA256
72a6ed7109dcfefee563c6f09fd4f22be99a6291152db251885e325461470550

SHA512
c01c8cb662554e52900e22950d056651433ab6d05b32fedaf3bbdf4539961d3ac1e62574722322b35c412789cb5b3874fcf19ba114ad76331bfa39f488ed1e28

Download Submit
C:\Users\Admin\AppData\Local\kGmJ9H\slc.dll
Filesize
988KB

MD5
c510d8d5bf4dd0fd39e0a75609eb198c

SHA1
ac936f8394d9042b96787fb154cc816ed4deb78f

SHA256
53bbe818e0d150e73402f3d094777512374d75bfb02f795bcb4ad383819138c4

SHA512
a03cee18f0f51f261ac9c911c96f85916795ca04e847c12dc000935f934b7a8ba6c47979baf0e42956cce684cd07dbf746d650d88be402b94d5b24b23cb463d9

Download Submit
C:\Users\Admin\AppData\Local\rkoy5cRxb\VERSION.dll
Filesize
987KB

MD5
62c68da80cb405e44f12a51c85d1b205

SHA1
115f1a6966229e38d4747eff9cccc17400487812

SHA256
9f16570e5b564b1a4e84b13071c40b95e159295098c828d1559488c088451b01

SHA512
04b1b7835a7a3bebd1356ae12940069901ac358d532518d00640500dfc381198eee4413de6ec89992ca3024040ee95ecb98e27b2a0e31028503d50d73bec75b3

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Tkjddllshxzvy.lnk
Filesize
964B

MD5
497e3765eec13f0d85a9972e89176276

SHA1
4d291f548339fbc40de7d2c8adf5272a53ac135e

SHA256
b6144847a76b7a27480463bf7c75051c17bd588a39bc9bb497cd46f9c3a6d9a4

SHA512
dd80f9de0f29ed417ccbca185838e76304acc78aeb8c53af8c4d2d90b27709ba7f43a9dde811dd6ccabf23a587d87f6fed799e71fc8b6882c71db39019ed58bc

Download Submit
\Users\Admin\AppData\Local\Iee5B\dpnsvr.exe
Filesize
33KB

MD5
6806b72978f6bd27aef57899be68b93b

SHA1
713c246d0b0b8dcc298afaed4f62aed82789951c

SHA256
3485ee4159c5f9e4ed9dd06e668d1e04148154ff40327a9ccb591e8c5a79958c

SHA512
43c942358b2e949751149ecc4be5ff6cb0634957ff1128ad5e6051e83379fb5643100cae2f6ef3eaf36aff016063c150e93297aa866e780d0e4d51656a251c7b

Download Submit
\Users\Admin\AppData\Local\kGmJ9H\rekeywiz.exe
Filesize
67KB

MD5
767c75767b00ccfd41a547bb7b2adfff

SHA1
91890853a5476def402910e6507417d400c0d3cb

SHA256
bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395

SHA512
f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9

Download Submit
\Users\Admin\AppData\Local\rkoy5cRxb\notepad.exe
Filesize
189KB

MD5
f2c7bb8acc97f92e987a2d4087d021b1

SHA1
7eb0139d2175739b3ccb0d1110067820be6abd29

SHA256
142e1d688ef0568370c37187fd9f2351d7ddeda574f8bfa9b0fa4ef42db85aa2

SHA512
2f37a2e503cffbd7c05c7d8a125b55368ce11aad5b62f17aaac7aaf3391a6886fa6a0fd73223e9f30072419bf5762a8af7958e805a52d788ba41f61eb084bfe8

Download Submit
memory/544-95-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/544-89-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/1144-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-4-0x0000000077506000-0x0000000077507000-memory.dmp

Filesize
4KB

Download
memory/1144-26-0x00000000778A0000-0x00000000778A2000-memory.dmp

Filesize
8KB

Download
memory/1144-25-0x0000000077711000-0x0000000077712000-memory.dmp

Filesize
4KB

Download
memory/1144-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-24-0x0000000002DB0000-0x0000000002DB7000-memory.dmp

Filesize
28KB

Download
memory/1144-38-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-5-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1144-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1144-63-0x0000000077506000-0x0000000077507000-memory.dmp

Filesize
4KB

Download
memory/1144-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1604-71-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1604-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1604-74-0x0000000000200000-0x0000000000207000-memory.dmp

Filesize
28KB

Download
memory/1948-0-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/1948-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1948-1-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2652-58-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2652-55-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2652-52-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads