dridex | 8dee4a77440b12c813b45a5e9bb21e68ab7150ecd230d7315f900ad4d6841229

General

Target

b83015ca9abbfa3a59dc3d5413860a96_JaffaCakes118.dll
Size

1.2MB
MD5

b83015ca9abbfa3a59dc3d5413860a96
SHA1

7147271a5540b3e0f1913cbfb3dd0fbce8db4132
SHA256

8dee4a77440b12c813b45a5e9bb21e68ab7150ecd230d7315f900ad4d6841229
SHA512

01c425db232a914023bc949d4a7d2085a8dfb44dc22bc15863b1b793978f73f01e0ad2c5d4a69890b3001bc2b7102db1d6f6efdcfa6e245d9b6354deea48d57e
SSDEEP

24576:kyTonNVlKTt/Q5ECvVP7hpJMvjtKpvPf9+m6kLRqgSyI:kyWRKTt/QlPVp3h9

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1204-5-0x0000000002610000-0x0000000002611000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

wextract.exefvenotify.exeBitLockerWizardElev.exe

pid process

2752 wextract.exe
2236 fvenotify.exe
2884 BitLockerWizardElev.exe
Loads dropped DLL 7 IoCs

Processes:

wextract.exefvenotify.exeBitLockerWizardElev.exe

pid process

1204
2752 wextract.exe
1204
2236 fvenotify.exe
1204
2884 BitLockerWizardElev.exe
1204

pid	process
2752	wextract.exe
2236	fvenotify.exe
2884	BitLockerWizardElev.exe

pid	process
1204
2752	wextract.exe
1204
2236	fvenotify.exe
1204
2884	BitLockerWizardElev.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mwyjnbrrs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\vLSoFe\\fvenotify.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

fvenotify.exeBitLockerWizardElev.exerundll32.exewextract.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fvenotify.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BitLockerWizardElev.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wextract.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1084	rundll32.exe
1084	rundll32.exe
1084	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 2524	1204	wextract.exe
PID 1204 wrote to memory of 2524	1204	wextract.exe
PID 1204 wrote to memory of 2524	1204	wextract.exe
PID 1204 wrote to memory of 2752	1204	wextract.exe
PID 1204 wrote to memory of 2752	1204	wextract.exe
PID 1204 wrote to memory of 2752	1204	wextract.exe
PID 1204 wrote to memory of 2364	1204	fvenotify.exe
PID 1204 wrote to memory of 2364	1204	fvenotify.exe
PID 1204 wrote to memory of 2364	1204	fvenotify.exe
PID 1204 wrote to memory of 2236	1204	fvenotify.exe
PID 1204 wrote to memory of 2236	1204	fvenotify.exe
PID 1204 wrote to memory of 2236	1204	fvenotify.exe
PID 1204 wrote to memory of 2876	1204	BitLockerWizardElev.exe
PID 1204 wrote to memory of 2876	1204	BitLockerWizardElev.exe
PID 1204 wrote to memory of 2876	1204	BitLockerWizardElev.exe
PID 1204 wrote to memory of 2884	1204	BitLockerWizardElev.exe
PID 1204 wrote to memory of 2884	1204	BitLockerWizardElev.exe
PID 1204 wrote to memory of 2884	1204	BitLockerWizardElev.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b83015ca9abbfa3a59dc3d5413860a96_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1084

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:2524

C:\Users\Admin\AppData\Local\2gVrkJ\wextract.exe
C:\Users\Admin\AppData\Local\2gVrkJ\wextract.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2752

C:\Windows\system32\fvenotify.exe
C:\Windows\system32\fvenotify.exe
1⤵
PID:2364

C:\Users\Admin\AppData\Local\lEFJlvj\fvenotify.exe
C:\Users\Admin\AppData\Local\lEFJlvj\fvenotify.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2236

C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\BitLockerWizardElev.exe
1⤵
PID:2876

C:\Users\Admin\AppData\Local\CtfIe\BitLockerWizardElev.exe
C:\Users\Admin\AppData\Local\CtfIe\BitLockerWizardElev.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2884

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2gVrkJ\VERSION.dll
Filesize
1.2MB

MD5
9186e4eb653a6ca388f4d3544e65e9da

SHA1
fef82319f556c93a01d8647dd331b2cb29e440b2

SHA256
54bb7308105acc107ff1e1f6bede1b93695943ea71c3abd30880bc353b1ad221

SHA512
0dbf318d02621fb8b6f672aa459506c911e074c305b70dca7afaed2df6230cf1920f5f50a1bd38a0ffb9f709831683e41cdfb928388f4093586966ece87da34e

Download Submit
C:\Users\Admin\AppData\Local\2gVrkJ\wextract.exe
Filesize
140KB

MD5
1ea6500c25a80e8bdb65099c509af993

SHA1
6a090ef561feb4ae1c6794de5b19c5e893c4aafc

SHA256
99123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2

SHA512
b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb

Download Submit
C:\Users\Admin\AppData\Local\CtfIe\FVEWIZ.dll
Filesize
1.2MB

MD5
e3b6487d34a755a89b45dc8d48776cd7

SHA1
792a704b4a55182aa3450dfba3de75595e6dd5ac

SHA256
b704c444ada4203479903280f0a325a3ed2f49d4537f7ab35fecc6d4a26c9e23

SHA512
e87111cc07621b8cd7246ae32c855eb4b9c78c178dee09521005be3b65d74806b568324389821751aa0a787e3e3bcde9993d272e8c86d6e521fd40c8f0b81390

Download Submit
C:\Users\Admin\AppData\Local\lEFJlvj\fvenotify.exe
Filesize
117KB

MD5
e61d644998e07c02f0999388808ac109

SHA1
183130ad81ff4c7997582a484e759bf7769592d6

SHA256
15a85cd6fbcb1ec57d78f986d6dd8908bd56231ce0cf65775075512303f7e5fa

SHA512
310141b73394ae12a35f8d4f0c097868ee8a8045a62dd402a5dfbe2151980dd4fe18409ae3ca9422e3b88b2fa9afb04c1acbf8ec23a937a0a242b32a9a1e9272

Download Submit
C:\Users\Admin\AppData\Local\lEFJlvj\slc.dll
Filesize
1.2MB

MD5
82d8cb27a342e16df8e335a2c600f207

SHA1
b39516474bb968e37d8803dfd6c9d4358d54daaf

SHA256
b347efac02c96e65c933c0996a56183b65111dc879805d0c2c15ea08a2d8428c

SHA512
054c478182a0ff8628c65f32dd769ade431fdd7d8bbbe0ba776b2d09f7e141e5799aca5c12223d79c8edf455c14907cc2fe314bc4619ee7d44840ac0c20cec8d

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Pclfpjzoauil.lnk
Filesize
1KB

MD5
1eabe41e57d5fb86867200528d308a6c

SHA1
5fd5ddd759fcf9aa023267aec9aaf1d8aff043fd

SHA256
1f8df17398861fe2a8e79505f3cfd468b13f4cdf908e966b610f22df4fe8a62d

SHA512
b82cb554cf417ba9490e03caf2d61720b78085aa7d3c689eebe19d6a5a62991d461dd2edc4b71148c69e2543899cc0908efbc07ae3addc88ed0c05f266028fe8

Download Submit
\Users\Admin\AppData\Local\CtfIe\BitLockerWizardElev.exe
Filesize
98KB

MD5
73f13d791e36d3486743244f16875239

SHA1
ed5ec55dbc6b3bda505f0a4c699c257c90c02020

SHA256
2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

SHA512
911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

Download Submit
memory/1084-46-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1084-0-0x0000000001D80000-0x0000000001D87000-memory.dmp

Filesize
28KB

Download
memory/1084-1-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-40-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-26-0x00000000025F0000-0x00000000025F7000-memory.dmp

Filesize
28KB

Download
memory/1204-25-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-37-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-31-0x0000000077900000-0x0000000077902000-memory.dmp

Filesize
8KB

Download
memory/1204-30-0x0000000077771000-0x0000000077772000-memory.dmp

Filesize
4KB

Download
memory/1204-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-13-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-4-0x0000000077566000-0x0000000077567000-memory.dmp

Filesize
4KB

Download
memory/1204-5-0x0000000002610000-0x0000000002611000-memory.dmp

Filesize
4KB

Download
memory/1204-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-75-0x0000000077566000-0x0000000077567000-memory.dmp

Filesize
4KB

Download
memory/2236-76-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/2236-79-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/2752-57-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2752-60-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/2752-54-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/2884-94-0x0000000000290000-0x0000000000297000-memory.dmp

Filesize
28KB

Download
memory/2884-97-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads