dridex | 1db857ac660020f99c43fea4c4eeef9a36ee5586d70588b072fb0e730dd6073a

General

Target

b03a89f91de77550a6def73999903440_JaffaCakes118.dll
Size

1.4MB
MD5

b03a89f91de77550a6def73999903440
SHA1

120f0618be088d54dde945c38ed5b2b02151eab3
SHA256

1db857ac660020f99c43fea4c4eeef9a36ee5586d70588b072fb0e730dd6073a
SHA512

821437cc214b295ceb5dc970b30c4e289583e2611105debbfaa112a95b95173bb60c925d8d76ff44759f567008ec7ca9f3c60f1db327314aebfe6290eade96be
SSDEEP

24576:CuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:K9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1148-5-0x0000000002590000-0x0000000002591000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

mfpmp.exedccw.exeAdapterTroubleshooter.exe

pid process

2372 mfpmp.exe
2696 dccw.exe
1584 AdapterTroubleshooter.exe
Loads dropped DLL 7 IoCs

Processes:

mfpmp.exedccw.exeAdapterTroubleshooter.exe

pid process

1148
2372 mfpmp.exe
1148
2696 dccw.exe
1148
1584 AdapterTroubleshooter.exe
1148

pid	process
2372	mfpmp.exe
2696	dccw.exe
1584	AdapterTroubleshooter.exe

pid	process
1148
2372	mfpmp.exe
1148
2696	dccw.exe
1148
1584	AdapterTroubleshooter.exe
1148

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Javhf = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\S-1-5-21-2297530677-1229052932-2803917579-1000\\TBhfrX\\dccw.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemfpmp.exedccw.exeAdapterTroubleshooter.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dccw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdapterTroubleshooter.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2276	rundll32.exe
2276	rundll32.exe
2276	rundll32.exe
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148
1148

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1148 wrote to memory of 2960	1148	mfpmp.exe
PID 1148 wrote to memory of 2960	1148	mfpmp.exe
PID 1148 wrote to memory of 2960	1148	mfpmp.exe
PID 1148 wrote to memory of 2372	1148	mfpmp.exe
PID 1148 wrote to memory of 2372	1148	mfpmp.exe
PID 1148 wrote to memory of 2372	1148	mfpmp.exe
PID 1148 wrote to memory of 2692	1148	dccw.exe
PID 1148 wrote to memory of 2692	1148	dccw.exe
PID 1148 wrote to memory of 2692	1148	dccw.exe
PID 1148 wrote to memory of 2696	1148	dccw.exe
PID 1148 wrote to memory of 2696	1148	dccw.exe
PID 1148 wrote to memory of 2696	1148	dccw.exe
PID 1148 wrote to memory of 1648	1148	AdapterTroubleshooter.exe
PID 1148 wrote to memory of 1648	1148	AdapterTroubleshooter.exe
PID 1148 wrote to memory of 1648	1148	AdapterTroubleshooter.exe
PID 1148 wrote to memory of 1584	1148	AdapterTroubleshooter.exe
PID 1148 wrote to memory of 1584	1148	AdapterTroubleshooter.exe
PID 1148 wrote to memory of 1584	1148	AdapterTroubleshooter.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b03a89f91de77550a6def73999903440_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2276

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:2960

C:\Users\Admin\AppData\Local\LGMGXH\mfpmp.exe
C:\Users\Admin\AppData\Local\LGMGXH\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2372

C:\Windows\system32\dccw.exe
C:\Windows\system32\dccw.exe
1⤵
PID:2692

C:\Users\Admin\AppData\Local\74sN2bdkd\dccw.exe
C:\Users\Admin\AppData\Local\74sN2bdkd\dccw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2696

C:\Windows\system32\AdapterTroubleshooter.exe
C:\Windows\system32\AdapterTroubleshooter.exe
1⤵
PID:1648

C:\Users\Admin\AppData\Local\QvCDppx\AdapterTroubleshooter.exe
C:\Users\Admin\AppData\Local\QvCDppx\AdapterTroubleshooter.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1584

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\74sN2bdkd\dxva2.dll
Filesize
1.4MB

MD5
d902fe4b404f5af529420b306c7eb03a

SHA1
abb8df9f04d8a464e7313a75f36d8f9a66c036ab

SHA256
b6d99837455caaecf784e7cdf27bbc8e200d66fec7a1b89803b70845106956a9

SHA512
d8be00083b425a796bba37773016db6631a7442ad5869895695937d3c0f988e48a1ba2e45720a8ce48137215d8af17a0c200c98c39175216bbdc7306e07acf30

Download Submit
C:\Users\Admin\AppData\Local\LGMGXH\MFPlat.DLL
Filesize
1.4MB

MD5
03b0767aeca1001ded18fb6e3878eb1f

SHA1
806d0cb3551d82c87626b77c24db64455356bd04

SHA256
6536bd9f271189bc38506f4e2d9f136a48f5e9e36e2faef1a81ba0b85650c960

SHA512
edeabc224fc1f053ffaf356606c5863b54f91e266d08c1de18b9e266cc8182718a4814af3647948f7ac64d4ca310045dab04b48f58b3ffe8f62e95eac9dee9ff

Download Submit
C:\Users\Admin\AppData\Local\QvCDppx\d3d9.dll
Filesize
1.4MB

MD5
5b58f7f8b9197b1a61a9a04dad1a4ce8

SHA1
5a9d84de45ee4b40f38e5488a161f9f21e9a8e00

SHA256
e487b0e2d8ee49f8b474831f4add731f763efeac4d10159c904c93a1ebf024f8

SHA512
db792e21d9a484d2f3b745a124ebdd444ebcd514e047b0b880d6a64f60302e2887be544de743602886d2e20d11a484e3bd2ab94a45481f0c900cd49ced851d6f

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Xwtifesqpwfy.lnk
Filesize
1KB

MD5
dc9ea682f386fe4463be228e7eeb8289

SHA1
4777125d14b1833d2a3c6ddd0cc571fd21bf65ff

SHA256
6350cf55dde96471374bf7141421fbac3beb443e439a3d8cab2743f89a2440f3

SHA512
47dc6b571efcd88f0018f8c0466485f671f69c476e40375557c309c692d1db03df3c4f920953deba6bcf51152d28001346f0e70978e28868a2219b7888fd117f

Download Submit
\Users\Admin\AppData\Local\74sN2bdkd\dccw.exe
Filesize
861KB

MD5
a46cee731351eb4146db8e8a63a5c520

SHA1
8ea441e4a77642e12987ac842b36034230edd731

SHA256
283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5

SHA512
3573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc

Download Submit
\Users\Admin\AppData\Local\LGMGXH\mfpmp.exe
Filesize
24KB

MD5
2d8600b94de72a9d771cbb56b9f9c331

SHA1
a0e2ac409159546183aa45875497844c4adb5aac

SHA256
7d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185

SHA512
3aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc

Download Submit
\Users\Admin\AppData\Local\QvCDppx\AdapterTroubleshooter.exe
Filesize
39KB

MD5
d4170c9ff5b2f85b0ce0246033d26919

SHA1
a76118e8775e16237cf00f2fb79718be0dc84db1

SHA256
d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da

SHA512
9c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608

Download Submit
memory/1148-17-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-9-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-19-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-4-0x0000000076C96000-0x0000000076C97000-memory.dmp

Filesize
4KB

Download
memory/1148-29-0x0000000076DA1000-0x0000000076DA2000-memory.dmp

Filesize
4KB

Download
memory/1148-16-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-15-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-14-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-13-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-12-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-11-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-10-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-28-0x0000000002570000-0x0000000002577000-memory.dmp

Filesize
28KB

Download
memory/1148-30-0x0000000076F30000-0x0000000076F32000-memory.dmp

Filesize
8KB

Download
memory/1148-40-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-39-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-5-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1148-27-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-18-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-7-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-8-0x0000000140000000-0x000000014016E000-memory.dmp

Filesize
1.4MB

Download
memory/1148-67-0x0000000076C96000-0x0000000076C97000-memory.dmp

Filesize
4KB

Download
memory/1584-96-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/1584-99-0x000007FEF5AD0000-0x000007FEF5C3F000-memory.dmp

Filesize
1.4MB

Download
memory/2276-48-0x000007FEF5AD0000-0x000007FEF5C3E000-memory.dmp

Filesize
1.4MB

Download
memory/2276-3-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2276-0-0x000007FEF5AD0000-0x000007FEF5C3E000-memory.dmp

Filesize
1.4MB

Download
memory/2372-60-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2372-62-0x000007FEF6B80000-0x000007FEF6CF0000-memory.dmp

Filesize
1.4MB

Download
memory/2372-56-0x000007FEF6B80000-0x000007FEF6CF0000-memory.dmp

Filesize
1.4MB

Download
memory/2696-75-0x0000000000520000-0x0000000000527000-memory.dmp

Filesize
28KB

Download
memory/2696-76-0x000007FEF5AD0000-0x000007FEF5C3F000-memory.dmp

Filesize
1.4MB

Download
memory/2696-81-0x000007FEF5AD0000-0x000007FEF5C3F000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads