dridex | 4b25b71b0279a338fc387043f74376f4d3d9b8151df7238b3c02b90fc9a69251

General

Target

88ddb49e0375d67f2af8e44d70096880_JaffaCakes118.dll
Size

987KB
MD5

88ddb49e0375d67f2af8e44d70096880
SHA1

a2b8b6a7f7f3361f2a8180d6060dc6e8b6d3e2a2
SHA256

4b25b71b0279a338fc387043f74376f4d3d9b8151df7238b3c02b90fc9a69251
SHA512

df5bd61c1a39a83b3ab9ab6f9b49bc5109fb17d437ef97140ef576b6d742d3a28f2f3002a123f1e761f0c53a97e136b7ce573ae8135503ca34fcbad26f699053
SSDEEP

24576:sVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL89:sV8hf6STw1ZlQauvzSq01ICe6zvm6

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1224-5-0x0000000002910000-0x0000000002911000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

wextract.exeRDVGHelper.exewbengine.exe

pid process

2524 wextract.exe
1060 RDVGHelper.exe
2704 wbengine.exe
Loads dropped DLL 7 IoCs

Processes:

wextract.exeRDVGHelper.exewbengine.exe

pid process

1224
2524 wextract.exe
1224
1060 RDVGHelper.exe
1224
2704 wbengine.exe
1224

pid	process
2524	wextract.exe
1060	RDVGHelper.exe
2704	wbengine.exe

pid	process
1224
2524	wextract.exe
1224
1060	RDVGHelper.exe
1224
2704	wbengine.exe
1224

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uxhwu = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\#SHARE~1\\YQTXB6Z2\\XYM\\RDVGHE~1.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

wbengine.exerundll32.exewextract.exeRDVGHelper.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wbengine.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wextract.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RDVGHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1300	rundll32.exe
1300	rundll32.exe
1300	rundll32.exe
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1224 wrote to memory of 2940	1224	wextract.exe
PID 1224 wrote to memory of 2940	1224	wextract.exe
PID 1224 wrote to memory of 2940	1224	wextract.exe
PID 1224 wrote to memory of 2524	1224	wextract.exe
PID 1224 wrote to memory of 2524	1224	wextract.exe
PID 1224 wrote to memory of 2524	1224	wextract.exe
PID 1224 wrote to memory of 1236	1224	RDVGHelper.exe
PID 1224 wrote to memory of 1236	1224	RDVGHelper.exe
PID 1224 wrote to memory of 1236	1224	RDVGHelper.exe
PID 1224 wrote to memory of 1060	1224	RDVGHelper.exe
PID 1224 wrote to memory of 1060	1224	RDVGHelper.exe
PID 1224 wrote to memory of 1060	1224	RDVGHelper.exe
PID 1224 wrote to memory of 564	1224	wbengine.exe
PID 1224 wrote to memory of 564	1224	wbengine.exe
PID 1224 wrote to memory of 564	1224	wbengine.exe
PID 1224 wrote to memory of 2704	1224	wbengine.exe
PID 1224 wrote to memory of 2704	1224	wbengine.exe
PID 1224 wrote to memory of 2704	1224	wbengine.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\88ddb49e0375d67f2af8e44d70096880_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1300

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:2940

C:\Users\Admin\AppData\Local\I0Cr0m\wextract.exe
C:\Users\Admin\AppData\Local\I0Cr0m\wextract.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2524

C:\Windows\system32\RDVGHelper.exe
C:\Windows\system32\RDVGHelper.exe
1⤵
PID:1236

C:\Users\Admin\AppData\Local\YnK1\RDVGHelper.exe
C:\Users\Admin\AppData\Local\YnK1\RDVGHelper.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1060

C:\Windows\system32\wbengine.exe
C:\Windows\system32\wbengine.exe
1⤵
PID:564

C:\Users\Admin\AppData\Local\A9bywC9\wbengine.exe
C:\Users\Admin\AppData\Local\A9bywC9\wbengine.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2704

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\I0Cr0m\VERSION.dll
Filesize
988KB

MD5
06fc14cfdd82ad81cd203f1e75dcddd5

SHA1
c06727842beb4b6ec75d50fabfc359711096a462

SHA256
511b5be4e2ba2cb18d619063857ad3ff3f1770e2b072d1b690f97fc891120069

SHA512
c03f0659c4acb38687c1415d97617814c01410259e3d4c5dc66e069536bb4ab8e4ebff467d64d1513eff3842a21eb149c05f1fed431ad765b979203569b8eddf

Download Submit
C:\Users\Admin\AppData\Local\YnK1\dwmapi.dll
Filesize
989KB

MD5
d168c484362f6a2dfd5a2ee10ac36bc0

SHA1
56870aca684748d56ecffde1023ec4157d27765d

SHA256
c1efde0ea04f50dc161f4b9140ef80673c5aa587722d21a44b05a6958bfed3d1

SHA512
2d12fe4087fbf85ce3c855bce94ef3b2096c512089b6f7937140b92c6deb9a451716414f29f5a4b87c32afdccf83a312a80ab82c9dab22ecfac1344609b1c230

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dgsmy.lnk
Filesize
1KB

MD5
af19fb931bf0b7821d56b780e433b314

SHA1
139df9e8ffd73893ac796bf8c75e0a32eab30a41

SHA256
bee9e8bdc1924da18781d93dea93d8fe9f253cbb06fac41be1f5e56752d78526

SHA512
4973a2bd1d473495aae978b112305cebe5b2a41c67f3b8bd464ffc9ac82400e1e9d59e605bd78616e42b3556aa25ed7ab79c978efae1a0c933ea900d86c52292

Download Submit
\Users\Admin\AppData\Local\A9bywC9\XmlLite.dll
Filesize
988KB

MD5
78c99e6d3f46911775b6a0391b39eba5

SHA1
da48b46e98bf16cc97d486ca41dc61fa8a5331fb

SHA256
0b89016fd38699e5b18c15aa8f8ee2b8165e647ce9d10ad49ca950cae40dbab3

SHA512
8643c324c2c964b3982ad7c23c1195551c80c78f1447d0ee59622eb78f9616d81dee58e02764ba881f2494b74331e66ae3f28b6ccafa8fe2d61b3f9edd1d0ddf

Download Submit
\Users\Admin\AppData\Local\A9bywC9\wbengine.exe
Filesize
1.4MB

MD5
78f4e7f5c56cb9716238eb57da4b6a75

SHA1
98b0b9db6ec5961dbb274eff433a8bc21f7e557b

SHA256
46a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af

SHA512
1a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2

Download Submit
\Users\Admin\AppData\Local\I0Cr0m\wextract.exe
Filesize
140KB

MD5
1ea6500c25a80e8bdb65099c509af993

SHA1
6a090ef561feb4ae1c6794de5b19c5e893c4aafc

SHA256
99123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2

SHA512
b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb

Download Submit
\Users\Admin\AppData\Local\YnK1\RDVGHelper.exe
Filesize
93KB

MD5
53fda4af81e7c4895357a50e848b7cfe

SHA1
01fb2d0210f1c47aaf684e31a9fb78f89bba9c0f

SHA256
62ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038

SHA512
dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051

Download Submit
memory/1060-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1060-71-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download
memory/1224-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-4-0x0000000076D36000-0x0000000076D37000-memory.dmp

Filesize
4KB

Download
memory/1224-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-25-0x0000000076E41000-0x0000000076E42000-memory.dmp

Filesize
4KB

Download
memory/1224-26-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1224-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-24-0x00000000028F0000-0x00000000028F7000-memory.dmp

Filesize
28KB

Download
memory/1224-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-5-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1224-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1224-63-0x0000000076D36000-0x0000000076D37000-memory.dmp

Filesize
4KB

Download
memory/1224-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1300-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1300-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1300-1-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2524-58-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2524-53-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2524-52-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2704-89-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2704-94-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads