dridex | 240a3850e0e1a7ab754fd9325e11cf6fcf5251e2b3f329f2de2930b39792f2d6

General

Target

a95463c4c15657eea00d42c7f5f4d0cd_JaffaCakes118.dll
Size

986KB
MD5

a95463c4c15657eea00d42c7f5f4d0cd
SHA1

5c44e306351f8055a871c4ba85fa48502dac3d1e
SHA256

240a3850e0e1a7ab754fd9325e11cf6fcf5251e2b3f329f2de2930b39792f2d6
SHA512

c29799b71728c6547515a805aacaee6908641ed54ffafc862cd0da9e3d548f58fb6740dd72cdb84e99886a331d4b69cfd75acf2ffb17988293f041c04fdaa68c
SSDEEP

24576:oVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:oV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3516-4-0x0000000007A60000-0x0000000007A61000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

MusNotificationUx.exeSystemPropertiesHardware.exeSystemSettingsRemoveDevice.exe

pid process

560 MusNotificationUx.exe
1132 SystemPropertiesHardware.exe
1404 SystemSettingsRemoveDevice.exe
Loads dropped DLL 3 IoCs

Processes:

MusNotificationUx.exeSystemPropertiesHardware.exeSystemSettingsRemoveDevice.exe

pid process

560 MusNotificationUx.exe
1132 SystemPropertiesHardware.exe
1404 SystemSettingsRemoveDevice.exe

pid	process
560	MusNotificationUx.exe
1132	SystemPropertiesHardware.exe
1404	SystemSettingsRemoveDevice.exe

pid	process
560	MusNotificationUx.exe
1132	SystemPropertiesHardware.exe
1404	SystemSettingsRemoveDevice.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Pruztwesow = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\Acrobat\\DC\\JSCache\\1e\\SystemPropertiesHardware.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeMusNotificationUx.exeSystemPropertiesHardware.exeSystemSettingsRemoveDevice.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MusNotificationUx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesHardware.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemSettingsRemoveDevice.exe

Modifies registry class 1 IoCs

Processes:

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
2512	rundll32.exe
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516
3516

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

pid process

3516
3516
3516
3516
3516
Suspicious use of SendNotifyMessage 3 IoCs

Processes:

pid process

3516
3516
3516
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3516

pid	process
3516
3516
3516
3516
3516

pid	process
3516
3516
3516

pid	process
3516

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3516 wrote to memory of 5076	3516	MusNotificationUx.exe
PID 3516 wrote to memory of 5076	3516	MusNotificationUx.exe
PID 3516 wrote to memory of 560	3516	MusNotificationUx.exe
PID 3516 wrote to memory of 560	3516	MusNotificationUx.exe
PID 3516 wrote to memory of 3304	3516	SystemPropertiesHardware.exe
PID 3516 wrote to memory of 3304	3516	SystemPropertiesHardware.exe
PID 3516 wrote to memory of 1132	3516	SystemPropertiesHardware.exe
PID 3516 wrote to memory of 1132	3516	SystemPropertiesHardware.exe
PID 3516 wrote to memory of 816	3516	SystemSettingsRemoveDevice.exe
PID 3516 wrote to memory of 816	3516	SystemSettingsRemoveDevice.exe
PID 3516 wrote to memory of 1404	3516	SystemSettingsRemoveDevice.exe
PID 3516 wrote to memory of 1404	3516	SystemSettingsRemoveDevice.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a95463c4c15657eea00d42c7f5f4d0cd_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2512

C:\Windows\system32\MusNotificationUx.exe
C:\Windows\system32\MusNotificationUx.exe
1⤵
PID:5076

C:\Users\Admin\AppData\Local\tYwgL3MX\MusNotificationUx.exe
C:\Users\Admin\AppData\Local\tYwgL3MX\MusNotificationUx.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:560

C:\Windows\system32\SystemPropertiesHardware.exe
C:\Windows\system32\SystemPropertiesHardware.exe
1⤵
PID:3304

C:\Users\Admin\AppData\Local\Zn6aUqGx\SystemPropertiesHardware.exe
C:\Users\Admin\AppData\Local\Zn6aUqGx\SystemPropertiesHardware.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1132

C:\Windows\system32\SystemSettingsRemoveDevice.exe
C:\Windows\system32\SystemSettingsRemoveDevice.exe
1⤵
PID:816

C:\Users\Admin\AppData\Local\Jcw\SystemSettingsRemoveDevice.exe
C:\Users\Admin\AppData\Local\Jcw\SystemSettingsRemoveDevice.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1404

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Jcw\DUI70.dll
Filesize
1.2MB

MD5
4e5e039a4f5bacaa103b38c82dfc1de7

SHA1
5e08bec9d70483c3133969a5573f49012491aec3

SHA256
9ad1806a4e0550f7ee1b8c245b853c0281b44321711ce537219f44bf0d04f592

SHA512
264aee506544c68b6a0782c8e4fee95aa81ece8ab9402ba1cf0e04efe274584500173d6afb0a1031f350cd1553d440051e38c0a5c66d5ecbd18f1d030196bf72

Download Submit
C:\Users\Admin\AppData\Local\Jcw\SystemSettingsRemoveDevice.exe
Filesize
39KB

MD5
7853f1c933690bb7c53c67151cbddeb0

SHA1
d47a1ad0ccba4c988c8ffc5cbf9636fd4f4fa6e6

SHA256
9500731b2a3442f11dfd08a8adfe027e7f32ef5834c628eed4b78be74168470d

SHA512
831993d610539d44422d769de6561a4622e1b9cb3d73253774b6cecabf57654a74cd88b4ebe20921585ea96d977225b9501f02a0f6a1fc7d2cad6824fd539304

Download Submit
C:\Users\Admin\AppData\Local\Zn6aUqGx\SYSDM.CPL
Filesize
986KB

MD5
c6ff0bf1ad2e0db3c03dc84fc06b7a4a

SHA1
f4cd8a96a2f0ec005b601a1936ee19e6f232502d

SHA256
873c042301e949931d4151b5d34bc3d9be0e043dd7cbf66beb4cb4a481d0acbf

SHA512
783d5fcc3552db595a59c9c4311c67151981c2af93bb9992337ac22ef7851dc07acf93b8a971725d4d811a5a3d20204c27b29563a9a6a5a5d610fdadeabea80b

Download Submit
C:\Users\Admin\AppData\Local\Zn6aUqGx\SystemPropertiesHardware.exe
Filesize
82KB

MD5
bf5bc0d70a936890d38d2510ee07a2cd

SHA1
69d5971fd264d8128f5633db9003afef5fad8f10

SHA256
c8ebd920399ebcf3ab72bd325b71a6b4c6119dfecea03f25059a920c4d32acc7

SHA512
0e129044777cbbf5ea995715159c50773c1818fc5e8faa5c827fd631b44c086b34dfdcbe174b105891ccc3882cc63a8664d189fb6a631d8f589de4e01a862f51

Download Submit
C:\Users\Admin\AppData\Local\tYwgL3MX\MusNotificationUx.exe
Filesize
615KB

MD5
869a214114a81712199f3de5d69d9aad

SHA1
be973e4188eff0d53fdf0e9360106e8ad946d89f

SHA256
405c2df9a36d7cfb5c8382c96f04792eb88c11a6cfa36b1d2ec3e0bec8d17361

SHA512
befcdeb8de6e68b9ee0bacd4cbc80f7393a0213d4039b239c98585e0cd5db1755c75559a62372374cbfb7132b6a7973ea9e6a31952e0e0ba007079c56e6d9012

Download Submit
C:\Users\Admin\AppData\Local\tYwgL3MX\XmlLite.dll
Filesize
986KB

MD5
c2f6fd6d86cfd367eda4258acf8730b8

SHA1
79ee35541a680c8ee365dbb355cc0bab455e05e4

SHA256
d2e52aed1e414aac1318f73b8301e1648d47f7e68857e94052fb75e919e8f1f6

SHA512
5517c0ce9b0c0f6b77d2f56fbed60b27b08d3ce5b858365c481654ff3c61389abe0896a2a0ec6a3f144f28ce1928defc28b6640addac2fd873e4a8d2afe7ed5c

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Arcabpqqvo.lnk
Filesize
1KB

MD5
56dfa64fd4000372fe380fc29bf5f8bf

SHA1
502b5936fdfe394acd48788d7c11dac826b61e9e

SHA256
49c81a0aed832a64327e37253fe1ad740f4033af87d0b0d0c1ac9aadff79b802

SHA512
f09897e655e40be03617cd6b819fd2ad854a5b1165f19b40daa9649228988cf664fa2961fb0b38c72bca8e058d6bc01cd86c3cc01c6437c5dcb25b2cab7096d8

Download Submit
memory/560-50-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/560-44-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/560-47-0x000001E5BB2A0000-0x000001E5BB2A7000-memory.dmp

Filesize
28KB

Download
memory/1132-67-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1132-64-0x0000027037830000-0x0000027037837000-memory.dmp

Filesize
28KB

Download
memory/1404-79-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1404-78-0x00000166532B0000-0x00000166532B7000-memory.dmp

Filesize
28KB

Download
memory/1404-84-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/2512-37-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2512-1-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2512-0-0x00000206D9DF0000-0x00000206D9DF7000-memory.dmp

Filesize
28KB

Download
memory/3516-34-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-28-0x00007FFF192D0000-0x00007FFF192E0000-memory.dmp

Filesize
64KB

Download
memory/3516-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-27-0x0000000007A40000-0x0000000007A47000-memory.dmp

Filesize
28KB

Download
memory/3516-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/3516-4-0x0000000007A60000-0x0000000007A61000-memory.dmp

Filesize
4KB

Download
memory/3516-6-0x00007FFF190CA000-0x00007FFF190CB000-memory.dmp

Filesize
4KB

Download
memory/3516-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads