dridex | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
151s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-06-2024 17:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stealers/Dridex.dll
Size

1.2MB
MD5

304109f9a5c3726818b4c3668fdb71fd
SHA1

2eb804e205d15d314e7f67d503940f69f5dc2ef8
SHA256

af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
SHA512

cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
SSDEEP

24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral22/memory/3296-4-0x0000000003310000-0x0000000003311000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

MoUsoCoreWorker.exeSystemPropertiesAdvanced.exeDmNotificationBroker.exe

pid process

3000 MoUsoCoreWorker.exe
792 SystemPropertiesAdvanced.exe
400 DmNotificationBroker.exe
Loads dropped DLL 3 IoCs

Processes:

MoUsoCoreWorker.exeSystemPropertiesAdvanced.exeDmNotificationBroker.exe

pid process

3000 MoUsoCoreWorker.exe
792 SystemPropertiesAdvanced.exe
400 DmNotificationBroker.exe

pid	process
3000	MoUsoCoreWorker.exe
792	SystemPropertiesAdvanced.exe
400	DmNotificationBroker.exe

pid	process
3000	MoUsoCoreWorker.exe
792	SystemPropertiesAdvanced.exe
400	DmNotificationBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xcdbzlxvqxxhz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\4Ohhvh\\SystemPropertiesAdvanced.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeMoUsoCoreWorker.exeSystemPropertiesAdvanced.exeDmNotificationBroker.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MoUsoCoreWorker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesAdvanced.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DmNotificationBroker.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1436	rundll32.exe
1436	rundll32.exe
1436	rundll32.exe
1436	rundll32.exe
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296
3296

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3296 wrote to memory of 2168	3296	MoUsoCoreWorker.exe
PID 3296 wrote to memory of 2168	3296	MoUsoCoreWorker.exe
PID 3296 wrote to memory of 3000	3296	MoUsoCoreWorker.exe
PID 3296 wrote to memory of 3000	3296	MoUsoCoreWorker.exe
PID 3296 wrote to memory of 2592	3296	SystemPropertiesAdvanced.exe
PID 3296 wrote to memory of 2592	3296	SystemPropertiesAdvanced.exe
PID 3296 wrote to memory of 792	3296	SystemPropertiesAdvanced.exe
PID 3296 wrote to memory of 792	3296	SystemPropertiesAdvanced.exe
PID 3296 wrote to memory of 2348	3296	DmNotificationBroker.exe
PID 3296 wrote to memory of 2348	3296	DmNotificationBroker.exe
PID 3296 wrote to memory of 400	3296	DmNotificationBroker.exe
PID 3296 wrote to memory of 400	3296	DmNotificationBroker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1436

C:\Windows\system32\MoUsoCoreWorker.exe
C:\Windows\system32\MoUsoCoreWorker.exe
1⤵
PID:2168

C:\Users\Admin\AppData\Local\iS9g\MoUsoCoreWorker.exe
C:\Users\Admin\AppData\Local\iS9g\MoUsoCoreWorker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3000

C:\Windows\system32\SystemPropertiesAdvanced.exe
C:\Windows\system32\SystemPropertiesAdvanced.exe
1⤵
PID:2592

C:\Users\Admin\AppData\Local\jjojMc\SystemPropertiesAdvanced.exe
C:\Users\Admin\AppData\Local\jjojMc\SystemPropertiesAdvanced.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:792

C:\Windows\system32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
1⤵
PID:2348

C:\Users\Admin\AppData\Local\cqAFtGf6\DmNotificationBroker.exe
C:\Users\Admin\AppData\Local\cqAFtGf6\DmNotificationBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:400

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4136 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\cqAFtGf6\DUI70.dll

Filesize
1.5MB

MD5
3c6fcbf1b387407ebf1282ae6893c31d

SHA1
750bfe247affe71481fa4ed09d70beac0cf24cfb

SHA256
1b2dd973a47f9e82e55303e392e91e807d9c5cb330da23eb9050ae178c4214d5

SHA512
1008075dcb2f50a78d6e058237315aff7d3d0c248c4e16583aa6ee42aab31b4c2fd7e0510db1543fbdccd375e13ad44b61894a1c1dadd22e3bb6b672990d72f8

Download Submit
C:\Users\Admin\AppData\Local\cqAFtGf6\DmNotificationBroker.exe

Filesize
32KB

MD5
f0bdc20540d314a2aad951c7e2c88420

SHA1
4ab344595a4a81ab5f31ed96d72f217b4cee790b

SHA256
f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5

SHA512
cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

Download Submit
C:\Users\Admin\AppData\Local\iS9g\MoUsoCoreWorker.exe

Filesize
1.6MB

MD5
47c6b45ff22b73caf40bb29392386ce3

SHA1
7e29a8d98fbb9b02d3d22e3576f4fd61ab50ffe9

SHA256
cbccb642725edb42e749e26ded68a16b3aa20e291a1a7793a2d4efebb75f99c0

SHA512
c919ab84a497616e7969d58c251f4e6efc337b41ef6956864b86d66ae1437294c124232fec54433eab3a6518ed529f8445dd0b23706b2f42f3fa42e69711f331

Download Submit
C:\Users\Admin\AppData\Local\iS9g\XmlLite.dll

Filesize
1.2MB

MD5
7a76818f31534e512f7f63d95b37dbe8

SHA1
8a21c04c4bed0fc441ac93e5e0056ac6caae9a32

SHA256
7b78699abe7ec5a35510e6400e439516ce0b178245a0fd65f423e781d5903059

SHA512
e964c6d9a10dcee6f672cef391b760372c84bbf9a82273935f554c1a743b96424847df2579e796d4459e4a557912c90efc4c3e991802810d08674684d5a36d8a

Download Submit
C:\Users\Admin\AppData\Local\jjojMc\SYSDM.CPL

Filesize
1.2MB

MD5
ef0cb0467a701669abd54f9a5cc1483d

SHA1
b9a82a117fdd226cad2bad47f739cabee35ccc30

SHA256
ab2d8ee1934413fec5784a0f002f9fa0860bb36b3d40c3ace7127abd2288dba3

SHA512
15a1903a8cdf77458c76074628a63dd62b9958f83edcefcf9eace372f75ca3421f23f90831d27af764ab1ad3fd22611b9b5c0270d054b2474412b225449804fd

Download Submit
C:\Users\Admin\AppData\Local\jjojMc\SystemPropertiesAdvanced.exe

Filesize
82KB

MD5
fa040b18d2d2061ab38cf4e52e753854

SHA1
b1b37124e9afd6c860189ce4d49cebbb2e4c57bc

SHA256
c61fa0f8c5d8d61110adbcceaa453a6c1d31255b3244dc7e3b605a4a931c245c

SHA512
511f5981bd2c446f1f3039f6674f972651512305630bd688b1ef159af36a23cb836b43d7010b132a86b5f4d6c46206057abd31600f1e7dc930cb32ed962298a4

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Axoeay.lnk

Filesize
1KB

MD5
db8fec722ca00a96bf76bf295b0db3a0

SHA1
eac22dd351c8e664b2495a4ea9726f6fcd2aecdc

SHA256
d4abf374463aeec3667a88ed592a5b3917edf1730d4469775dec3a87185d376a

SHA512
506a2d286f4278836b82704bdb4b0ce892ab2335a2c27c5b0d5eab1987e4e99d10e0359eee228f56f9eafbf69e232d24a50dc3c619d9962e36cb46cbeef03103

Download Submit
memory/400-81-0x0000000140000000-0x0000000140189000-memory.dmp

Filesize
1.5MB

Download
memory/400-80-0x0000019F47670000-0x0000019F47677000-memory.dmp

Filesize
28KB

Download
memory/400-86-0x0000000140000000-0x0000000140189000-memory.dmp

Filesize
1.5MB

Download
memory/792-69-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/792-63-0x000001DD3C5A0000-0x000001DD3C5A7000-memory.dmp

Filesize
28KB

Download
memory/1436-0-0x000001AF6B1B0000-0x000001AF6B1B7000-memory.dmp

Filesize
28KB

Download
memory/1436-39-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1436-1-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3000-52-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3000-49-0x00000267D15D0000-0x00000267D15D7000-memory.dmp

Filesize
28KB

Download
memory/3000-46-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3296-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-36-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-26-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-25-0x0000000001390000-0x0000000001397000-memory.dmp

Filesize
28KB

Download
memory/3296-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-29-0x00007FFEF6050000-0x00007FFEF6060000-memory.dmp

Filesize
64KB

Download
memory/3296-24-0x00007FFEF537A000-0x00007FFEF537B000-memory.dmp

Filesize
4KB

Download
memory/3296-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-6-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/3296-4-0x0000000003310000-0x0000000003311000-memory.dmp

Filesize
4KB

Download