dridex | 58a7b50c5201c447d6259a1dcd04e0f0d54ad73cf5a4a9cbe7bc2d7eb1ca8887

General

Target

ad83edd17de18486efe22dc738daeae5_JaffaCakes118.dll
Size

990KB
MD5

ad83edd17de18486efe22dc738daeae5
SHA1

d02937cc07297a06bd372334a4b01cf19f34740a
SHA256

58a7b50c5201c447d6259a1dcd04e0f0d54ad73cf5a4a9cbe7bc2d7eb1ca8887
SHA512

9aa535f0ada29522f228732ea1808d60e3a819d4172ba6f704e3d893f655deb2cfd245d9738259dba6ec86fe56fbbbedcc59ed4e7db09d4a1c01b4f9a5a64b9d
SSDEEP

24576:SVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:SV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1204-5-0x0000000002650000-0x0000000002651000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

ComputerDefaults.exeraserver.exemfpmp.exe

pid process

3036 ComputerDefaults.exe
2568 raserver.exe
1948 mfpmp.exe
Loads dropped DLL 7 IoCs

Processes:

ComputerDefaults.exeraserver.exemfpmp.exe

pid process

1204
3036 ComputerDefaults.exe
1204
2568 raserver.exe
1204
1948 mfpmp.exe
1204

pid	process
3036	ComputerDefaults.exe
2568	raserver.exe
1948	mfpmp.exe

pid	process
1204
3036	ComputerDefaults.exe
1204
2568	raserver.exe
1204
1948	mfpmp.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nnwuocalikj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\1DfpD9H\\raserver.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeComputerDefaults.exeraserver.exemfpmp.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComputerDefaults.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	raserver.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2072	rundll32.exe
2072	rundll32.exe
2072	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 2656	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2656	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2656	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 3036	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 3036	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 3036	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2536	1204	raserver.exe
PID 1204 wrote to memory of 2536	1204	raserver.exe
PID 1204 wrote to memory of 2536	1204	raserver.exe
PID 1204 wrote to memory of 2568	1204	raserver.exe
PID 1204 wrote to memory of 2568	1204	raserver.exe
PID 1204 wrote to memory of 2568	1204	raserver.exe
PID 1204 wrote to memory of 1632	1204	mfpmp.exe
PID 1204 wrote to memory of 1632	1204	mfpmp.exe
PID 1204 wrote to memory of 1632	1204	mfpmp.exe
PID 1204 wrote to memory of 1948	1204	mfpmp.exe
PID 1204 wrote to memory of 1948	1204	mfpmp.exe
PID 1204 wrote to memory of 1948	1204	mfpmp.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ad83edd17de18486efe22dc738daeae5_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Windows\system32\ComputerDefaults.exe
C:\Windows\system32\ComputerDefaults.exe
1⤵
PID:2656

C:\Users\Admin\AppData\Local\i78aHS\ComputerDefaults.exe
C:\Users\Admin\AppData\Local\i78aHS\ComputerDefaults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3036

C:\Windows\system32\raserver.exe
C:\Windows\system32\raserver.exe
1⤵
PID:2536

C:\Users\Admin\AppData\Local\MoTvt8\raserver.exe
C:\Users\Admin\AppData\Local\MoTvt8\raserver.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2568

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:1632

C:\Users\Admin\AppData\Local\Z52q\mfpmp.exe
C:\Users\Admin\AppData\Local\Z52q\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1948

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MoTvt8\WTSAPI32.dll
Filesize
992KB

MD5
1c2921857730eed768a128cc1251d9d1

SHA1
2c347a1844e2987ba9ecf139e61730fad1f76e80

SHA256
955ce67cabcbd3e73deb2a123b2d359492171615eb366063e3167d7dd35c7a0a

SHA512
2cc208f39c40cd06bd2ebcd3858741ea7fbb49e9c17b9fdbfac62627beeae253cb6233672c0e039feb0bf965aa913ef788cea48ca315c4a45d21a5263d094541

Download Submit
C:\Users\Admin\AppData\Local\Z52q\MFPlat.DLL
Filesize
996KB

MD5
f20a5f4ba90a83e0a934489288ba5679

SHA1
6b5b9cbd17792fc668499177c6c4cd658fed45d3

SHA256
95bc8ffaa2735770fc17aa9f883d73e9e2fbd72c101464953cb7438916de1967

SHA512
ede2a56d58db9b0bce48dbb66ccd013f0b997843302346c2cf940ac2fdc2b3fb32426f62adb62cb611d8000ff8e9c9f230d75b5767229f5b8e161bf786fa4866

Download Submit
C:\Users\Admin\AppData\Local\i78aHS\appwiz.cpl
Filesize
991KB

MD5
b3a1f8a420284057eab562a15b320863

SHA1
255971fb647e8e666dbe4ccef1a7602e64687aff

SHA256
a61847ce94206397068e3645da58cace9a36e765d6754acdf1eb6bf32b7aad9a

SHA512
77b6d108a3afc99933d2f17021abdb5618effef6b1370614e3f057127a062e31fe23c7dccc08bfb9eb4a258c94f4f037d3c721dec1d2286151c09a664d2cc5b1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Eyoyeoki.lnk
Filesize
1KB

MD5
bb5b39ae7f07722a046b6ed553c3a5a2

SHA1
5f96784cfcc12933a0fda920e47f28525d557223

SHA256
ae602e5ceb266dc6289c8857c49cbc6118a3b4e7287729eac692297d3945af29

SHA512
5411ef00c6219526090b95007fb27e22d452cb700e8a8c4753f261dff50dcdc023e858f93e26398b88149840e422bc8a11067c030eb17aea0988b1e906c889c7

Download Submit
\Users\Admin\AppData\Local\MoTvt8\raserver.exe
Filesize
123KB

MD5
cd0bc0b6b8d219808aea3ecd4e889b19

SHA1
9f8f4071ce2484008e36fdfd963378f4ebad703f

SHA256
16abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c

SHA512
84291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac

Download Submit
\Users\Admin\AppData\Local\Z52q\mfpmp.exe
Filesize
24KB

MD5
2d8600b94de72a9d771cbb56b9f9c331

SHA1
a0e2ac409159546183aa45875497844c4adb5aac

SHA256
7d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185

SHA512
3aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc

Download Submit
\Users\Admin\AppData\Local\i78aHS\ComputerDefaults.exe
Filesize
36KB

MD5
86bd981f55341273753ac42ea200a81e

SHA1
14fe410efc9aeb0a905b984ac27719ff0dd10ea7

SHA256
40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

SHA512
49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

Download Submit
memory/1204-14-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-37-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-5-0x0000000002650000-0x0000000002651000-memory.dmp

Filesize
4KB

Download
memory/1204-13-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-12-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-11-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-10-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-9-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-26-0x0000000077251000-0x0000000077252000-memory.dmp

Filesize
4KB

Download
memory/1204-27-0x00000000773E0000-0x00000000773E2000-memory.dmp

Filesize
8KB

Download
memory/1204-36-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-4-0x0000000077146000-0x0000000077147000-memory.dmp

Filesize
4KB

Download
memory/1204-24-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-25-0x0000000002630000-0x0000000002637000-memory.dmp

Filesize
28KB

Download
memory/1204-15-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-7-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-8-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1204-64-0x0000000077146000-0x0000000077147000-memory.dmp

Filesize
4KB

Download
memory/1948-91-0x0000000140000000-0x00000001400FF000-memory.dmp

Filesize
1020KB

Download
memory/1948-96-0x0000000140000000-0x00000001400FF000-memory.dmp

Filesize
1020KB

Download
memory/1948-90-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2072-1-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2072-45-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2072-0-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/2568-78-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2568-75-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/3036-59-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/3036-54-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/3036-53-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads