dridex | ff606bc5ec4c065454914bdb2ea526a8f2dfa2ff635b18124799922cd8f4395d

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
28/07/2024, 10:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13e1a42e69f65bb0ba2b34cf2af03ccc_JaffaCakes118.dll
Size

1.2MB
MD5

13e1a42e69f65bb0ba2b34cf2af03ccc
SHA1

5c28617b1b763dbf9d0de3c0c5c009b719c6e022
SHA256

ff606bc5ec4c065454914bdb2ea526a8f2dfa2ff635b18124799922cd8f4395d
SHA512

54e2a898132028d76ebd6ad31f85b455a42f15a7ba495add6511266f31ad522806fcc828639b12e3b0dc1a511f917adbddabf675a13cbd9e533312926274c9b4
SSDEEP

24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1200-5-0x00000000021F0000-0x00000000021F1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2592	msdt.exe
1224	rdpshell.exe
2880	MpSigStub.exe

Loads dropped DLL 7 IoCs

pid	Process
1200	Process not Found
2592	msdt.exe
1200	Process not Found
1224	rdpshell.exe
1200	Process not Found
2880	MpSigStub.exe
1200	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qntpnaypazzlupr = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\2oLhtQU7Fh\\rdpshell.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msdt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpshell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2364	rundll32.exe
2364	rundll32.exe
2364	rundll32.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2556	1200	Process not Found	30
PID 1200 wrote to memory of 2556	1200	Process not Found	30
PID 1200 wrote to memory of 2556	1200	Process not Found	30
PID 1200 wrote to memory of 2592	1200	Process not Found	31
PID 1200 wrote to memory of 2592	1200	Process not Found	31
PID 1200 wrote to memory of 2592	1200	Process not Found	31
PID 1200 wrote to memory of 1032	1200	Process not Found	32
PID 1200 wrote to memory of 1032	1200	Process not Found	32
PID 1200 wrote to memory of 1032	1200	Process not Found	32
PID 1200 wrote to memory of 1224	1200	Process not Found	33
PID 1200 wrote to memory of 1224	1200	Process not Found	33
PID 1200 wrote to memory of 1224	1200	Process not Found	33
PID 1200 wrote to memory of 3056	1200	Process not Found	34
PID 1200 wrote to memory of 3056	1200	Process not Found	34
PID 1200 wrote to memory of 3056	1200	Process not Found	34
PID 1200 wrote to memory of 2880	1200	Process not Found	35
PID 1200 wrote to memory of 2880	1200	Process not Found	35
PID 1200 wrote to memory of 2880	1200	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\13e1a42e69f65bb0ba2b34cf2af03ccc_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2364

C:\Windows\system32\msdt.exe
C:\Windows\system32\msdt.exe
1⤵
PID:2556

C:\Users\Admin\AppData\Local\Vaj\msdt.exe
C:\Users\Admin\AppData\Local\Vaj\msdt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2592

C:\Windows\system32\rdpshell.exe
C:\Windows\system32\rdpshell.exe
1⤵
PID:1032

C:\Users\Admin\AppData\Local\ymv9oZuBf\rdpshell.exe
C:\Users\Admin\AppData\Local\ymv9oZuBf\rdpshell.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1224

C:\Windows\system32\MpSigStub.exe
C:\Windows\system32\MpSigStub.exe
1⤵
PID:3056

C:\Users\Admin\AppData\Local\ctIluUpf\MpSigStub.exe
C:\Users\Admin\AppData\Local\ctIluUpf\MpSigStub.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\ctIluUpf\VERSION.dll

Filesize
1.2MB

MD5
0b327e8810c604dfc1a059aa6e19de1c

SHA1
f3ac8c9fd6d9e8f5db8dabd661f7cd2c64243be1

SHA256
384b36dc952aa58497b8dfb32460a8611bf1a34604bc10a79e061a230f9ad927

SHA512
d4a189d3901c299fe623ffbef2e22fb05476364760f2f4d3b7dad7ec9fd318cb612966c74ca96b9bd4872abf6db7b55490125a72a93d8ccd4b2739975d01a374

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Joeqzcwrjre.lnk

Filesize
752B

MD5
9358d8c3e7c2997d7098efda986d3c54

SHA1
b264d994c65e4be810c0e82d237e9bbd3b77fbf5

SHA256
c48e8fdc0860476831d243874927c8980a14793832661889f1176d4d580448df

SHA512
9612dd5d119a70990ab75ee6110a5ca33d21774bff2db30fa2ca08830052d7dbfd88013be67a7e4190e6cd03a308e79884e184d31ed89906ee47b57b66d71e48

Download Submit
\Users\Admin\AppData\Local\Vaj\DUser.dll

Filesize
1.2MB

MD5
6fa2fd80e897debd79aa0d6a30927cf1

SHA1
bd309fcda3c033b5bb56cfdf19bbd172aa24f386

SHA256
3c71f89244caa62e6603fc3c069c053ec487032baf6acaebf8a5b42908b4170a

SHA512
56516b34bab3a5d125fcbd109d26398f080e5d2793738a3801e9567888ae0f1011ca64310563f9d66f92892162f37b6c5dcc796a38c873b251f8ee8b87e9ca37

Download Submit
\Users\Admin\AppData\Local\Vaj\msdt.exe

Filesize
1.0MB

MD5
aecb7b09566b1f83f61d5a4b44ae9c7e

SHA1
3a4a2338c6b5ac833dc87497e04fe89c5481e289

SHA256
fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5

SHA512
6e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746

Download Submit
\Users\Admin\AppData\Local\ctIluUpf\MpSigStub.exe

Filesize
264KB

MD5
2e6bd16aa62e5e95c7b256b10d637f8f

SHA1
350be084477b1fe581af83ca79eb58d4defe260f

SHA256
d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3

SHA512
1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

Download Submit
\Users\Admin\AppData\Local\ymv9oZuBf\WINSTA.dll

Filesize
1.2MB

MD5
8b1ac21403c1ade56840174476b8caa6

SHA1
37984f85e2241783446c045469c083dcd3893373

SHA256
e52ec89dbfabb03dfd273152b1109d9b5bc31ce8e08f9c8471155b62465737c8

SHA512
32ae0e9d5783f51e6f32bd9fd5548bc269a384d019842a946fbd2c84f1340a009398e6f8c892182f5babf7bb5b9945fdab6fb43a9ac8fbca73aaf3275f241726

Download Submit
\Users\Admin\AppData\Local\ymv9oZuBf\rdpshell.exe

Filesize
292KB

MD5
a62dfcea3a58ba8fcf32f831f018fe3f

SHA1
75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b

SHA256
f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e

SHA512
9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

Download Submit
memory/1200-26-0x0000000077931000-0x0000000077932000-memory.dmp

Filesize
4KB

Download
memory/1200-25-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-4-0x0000000077726000-0x0000000077727000-memory.dmp

Filesize
4KB

Download
memory/1200-16-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-15-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-14-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-13-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-12-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-11-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-10-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-9-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-38-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-37-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-5-0x00000000021F0000-0x00000000021F1000-memory.dmp

Filesize
4KB

Download
memory/1200-24-0x00000000021D0000-0x00000000021D7000-memory.dmp

Filesize
28KB

Download
memory/1200-27-0x0000000077AC0000-0x0000000077AC2000-memory.dmp

Filesize
8KB

Download
memory/1200-74-0x0000000077726000-0x0000000077727000-memory.dmp

Filesize
4KB

Download
memory/1200-7-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-8-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1224-71-0x000007FEF7BE0000-0x000007FEF7D12000-memory.dmp

Filesize
1.2MB

Download
memory/1224-75-0x0000000001BC0000-0x0000000001BC7000-memory.dmp

Filesize
28KB

Download
memory/1224-78-0x000007FEF7BE0000-0x000007FEF7D12000-memory.dmp

Filesize
1.2MB

Download
memory/2364-45-0x000007FEF7BF0000-0x000007FEF7D20000-memory.dmp

Filesize
1.2MB

Download
memory/2364-0-0x000007FEF7BF0000-0x000007FEF7D20000-memory.dmp

Filesize
1.2MB

Download
memory/2364-3-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2592-59-0x000007FEF7D10000-0x000007FEF7E41000-memory.dmp

Filesize
1.2MB

Download
memory/2592-53-0x000007FEF7D10000-0x000007FEF7E41000-memory.dmp

Filesize
1.2MB

Download
memory/2592-56-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2880-91-0x000007FEF7BE0000-0x000007FEF7D11000-memory.dmp

Filesize
1.2MB

Download
memory/2880-90-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2880-96-0x000007FEF7BE0000-0x000007FEF7D11000-memory.dmp

Filesize
1.2MB

Download