dridex | 3f8dbdd32edf0643d8008fdbaef3019604a9954488470c62eac3c5ed75ec94bf

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
29-07-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

33fb7c1f5419fc3b4a9e0702f5c82176_JaffaCakes118.dll
Size

1.2MB
MD5

33fb7c1f5419fc3b4a9e0702f5c82176
SHA1

0e3dcd49eb06367121404d3bff24ad472d03db23
SHA256

3f8dbdd32edf0643d8008fdbaef3019604a9954488470c62eac3c5ed75ec94bf
SHA512

c3a0cdf9db68b9241f9b993184da0830753328e464822b35807d1cd1538d2977f701fa6bb11002100d3fda251db75c4f2ce383d6724c862cf370aa56b8f032cf
SSDEEP

24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1204-5-0x0000000002E90000-0x0000000002E91000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

SystemPropertiesHardware.exedccw.exemsra.exe

pid	Process
2992	SystemPropertiesHardware.exe
1808	dccw.exe
1516	msra.exe

Loads dropped DLL 7 IoCs

Processes:

SystemPropertiesHardware.exedccw.exemsra.exe

pid	Process
1204
2992	SystemPropertiesHardware.exe
1204
1808	dccw.exe
1204
1516	msra.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rjrgyymfyoxefs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\fOro7i9a\\dccw.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeSystemPropertiesHardware.exedccw.exemsra.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesHardware.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dccw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msra.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
2416	rundll32.exe
2416	rundll32.exe
2416	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	procid_target
PID 1204 wrote to memory of 2864	1204	30
PID 1204 wrote to memory of 2864	1204	30
PID 1204 wrote to memory of 2864	1204	30
PID 1204 wrote to memory of 2992	1204	31
PID 1204 wrote to memory of 2992	1204	31
PID 1204 wrote to memory of 2992	1204	31
PID 1204 wrote to memory of 2156	1204	33
PID 1204 wrote to memory of 2156	1204	33
PID 1204 wrote to memory of 2156	1204	33
PID 1204 wrote to memory of 1808	1204	34
PID 1204 wrote to memory of 1808	1204	34
PID 1204 wrote to memory of 1808	1204	34
PID 1204 wrote to memory of 1760	1204	35
PID 1204 wrote to memory of 1760	1204	35
PID 1204 wrote to memory of 1760	1204	35
PID 1204 wrote to memory of 1516	1204	36
PID 1204 wrote to memory of 1516	1204	36
PID 1204 wrote to memory of 1516	1204	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\33fb7c1f5419fc3b4a9e0702f5c82176_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2416

C:\Windows\system32\SystemPropertiesHardware.exe
C:\Windows\system32\SystemPropertiesHardware.exe
1⤵
PID:2864

C:\Users\Admin\AppData\Local\OQ0UMR8Iz\SystemPropertiesHardware.exe
C:\Users\Admin\AppData\Local\OQ0UMR8Iz\SystemPropertiesHardware.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2992

C:\Windows\system32\dccw.exe
C:\Windows\system32\dccw.exe
1⤵
PID:2156

C:\Users\Admin\AppData\Local\FXe09T\dccw.exe
C:\Users\Admin\AppData\Local\FXe09T\dccw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1808

C:\Windows\system32\msra.exe
C:\Windows\system32\msra.exe
1⤵
PID:1760

C:\Users\Admin\AppData\Local\kO0XgdhY\msra.exe
C:\Users\Admin\AppData\Local\kO0XgdhY\msra.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\FXe09T\mscms.dll

Filesize
1.2MB

MD5
64970389918de06e9e83cf4e99849ba8

SHA1
6d2f5fe756bff25ecb12ead125dd14247a86b89e

SHA256
9c7bce533a55556ea515ec1b9c0edb41121812bf5c3e3a33235fe2bdaf5bf9eb

SHA512
479181a0e293d768ec5b2454e276e022fa8f4c6a6693bc7965cb06223b3fae6d4db272fc72106627e1e3ed053b2ee507a3535b071eda626947072cbe1eb7c058

Download Submit
C:\Users\Admin\AppData\Local\OQ0UMR8Iz\SYSDM.CPL

Filesize
1.2MB

MD5
0ab33e119c6d4c4bf4c3ac903878d455

SHA1
6574e666f510db7c257770f1f79b1e6f295c327d

SHA256
2c0cd427caa99ed5bbb0aae3f922850ee6f8c2d9136e6a91c763cc69279d03d3

SHA512
d20438264c08c51bd6691763dd4e513598b71de56cac33f612f20d61d195daf4d4ac5ecc698640071b6c0ede24a33b460514981fa89f41aff992940ea1d9b055

Download Submit
C:\Users\Admin\AppData\Local\OQ0UMR8Iz\SystemPropertiesHardware.exe

Filesize
80KB

MD5
c63d722641c417764247f683f9fb43be

SHA1
948ec61ebf241c4d80efca3efdfc33fe746e3b98

SHA256
4759296b421d60c80db0bb112a30425e04883900374602e13ed97f7c03a49df2

SHA512
7223d1c81a4785ed790ec2303d5d9d7ebcae9404d7bf173b3145e51202564de9977e94ac10ab80c6fe49b5f697af3ec70dfd922a891915e8951b5a1b5841c8be

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dwxzrb.lnk

Filesize
870B

MD5
c7fb08dafed18e05beaa87f5443a1c64

SHA1
6b82ebab2f22f1eb235b2b44fb87f4acb264ba31

SHA256
a6c3a382f98363146d63e4b964e6d8d47092b71180bce1a5c34baf01f0e1ab2d

SHA512
fce83712100fc0aa3906eb11e9a8c365785228cf0d1fa567041e3ca2bb395ffbe916c1be5ffd20868022749c75b354dba194b465f42ae4f0a36ad2f4e57e7a4a

Download Submit
\Users\Admin\AppData\Local\FXe09T\dccw.exe

Filesize
861KB

MD5
a46cee731351eb4146db8e8a63a5c520

SHA1
8ea441e4a77642e12987ac842b36034230edd731

SHA256
283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5

SHA512
3573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc

Download Submit
\Users\Admin\AppData\Local\kO0XgdhY\NDFAPI.DLL

Filesize
1.2MB

MD5
54eebb5c8280904cc853c3f934b59e77

SHA1
ff6b08af148e358ef11413ea5b17aac0dc9b90ed

SHA256
85300ed66a7e799f015aacf3b83d862f4180d61f8d44d646a7c2777c09846e72

SHA512
e70ead5f21c6e8b976384fc734b6e89a3b27c2c20e3c66d9bf68da80abe2129ee5d8ff593b3362abb3e96e3531eab1d132952c5c7250cc34693e2d000d0717bc

Download Submit
\Users\Admin\AppData\Local\kO0XgdhY\msra.exe

Filesize
636KB

MD5
e79df53bad587e24b3cf965a5746c7b6

SHA1
87a97ec159a3fc1db211f3c2c62e4d60810e7a70

SHA256
4e7c22648acf664ab13dfeb2dc062ae90af1e6c621186981f395fb279bbc9b9d

SHA512
9a329c39ce0bc5aede01e96c4190cc7ccd17729fbc3a2b6df73057be8efaa3fa92cfef6e26a25bde6f7f94f64f6d6d0e4c5459aef2aead367e43178dd275acfb

Download Submit
memory/1204-30-0x00000000778B0000-0x00000000778B2000-memory.dmp

Filesize
8KB

Download
memory/1204-17-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-4-0x0000000077616000-0x0000000077617000-memory.dmp

Filesize
4KB

Download
memory/1204-27-0x0000000077721000-0x0000000077722000-memory.dmp

Filesize
4KB

Download
memory/1204-25-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-26-0x0000000002E70000-0x0000000002E77000-memory.dmp

Filesize
28KB

Download
memory/1204-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-37-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-38-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-5-0x0000000002E90000-0x0000000002E91000-memory.dmp

Filesize
4KB

Download
memory/1204-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-13-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1204-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1516-92-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/1516-95-0x000007FEF6540000-0x000007FEF6672000-memory.dmp

Filesize
1.2MB

Download
memory/1808-72-0x000007FEF6540000-0x000007FEF6672000-memory.dmp

Filesize
1.2MB

Download
memory/1808-77-0x000007FEF6540000-0x000007FEF6672000-memory.dmp

Filesize
1.2MB

Download
memory/2416-46-0x000007FEF6540000-0x000007FEF6671000-memory.dmp

Filesize
1.2MB

Download
memory/2416-3-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2416-0-0x000007FEF6540000-0x000007FEF6671000-memory.dmp

Filesize
1.2MB

Download
memory/2992-57-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2992-60-0x000007FEF6E50000-0x000007FEF6F82000-memory.dmp

Filesize
1.2MB

Download
memory/2992-54-0x000007FEF6E50000-0x000007FEF6F82000-memory.dmp

Filesize
1.2MB

Download