dridex | 9d825d941408f6e8d7d47ced824b3e78a5346d0bc899f41ea51d53abbe5d5a13

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17-08-2024 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a20721654c3fced2cf5ecc9bed5fd3a3_JaffaCakes118.dll
Size

1.2MB
MD5

a20721654c3fced2cf5ecc9bed5fd3a3
SHA1

e1bc4896d120d6ebaf569f6c0a1f8f3fe3b2ae2b
SHA256

9d825d941408f6e8d7d47ced824b3e78a5346d0bc899f41ea51d53abbe5d5a13
SHA512

434b92c682705ea985f15a39d6771865d3449fea6cd6941604dfce800d95285833ba3b0532d088497867032d6e8680288302acbe866229822280dbc00c940211
SSDEEP

24576:CuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:K9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3428-4-0x0000000007440000-0x0000000007441000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

slui.exemsra.exeSystemPropertiesDataExecutionPrevention.exe

pid	Process
5016	slui.exe
3916	msra.exe
632	SystemPropertiesDataExecutionPrevention.exe

Loads dropped DLL 3 IoCs

Processes:

slui.exemsra.exeSystemPropertiesDataExecutionPrevention.exe

pid	Process
5016	slui.exe
3916	msra.exe
632	SystemPropertiesDataExecutionPrevention.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tdfoxulv = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\d3xZRA\\msra.exe"

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

slui.exemsra.exeSystemPropertiesDataExecutionPrevention.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msra.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesDataExecutionPrevention.exe

Modifies registry class 1 IoCs

Processes:

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

regsvr32.exe

pid	Process
3520	regsvr32.exe
3520	regsvr32.exe
3520	regsvr32.exe
3520	regsvr32.exe
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428
3428

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

description	pid	Process
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428
Token: SeShutdownPrivilege	3428
Token: SeCreatePagefilePrivilege	3428

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid	Process
3428
3428

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid	Process
3428

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	procid_target
PID 3428 wrote to memory of 2852	3428	95
PID 3428 wrote to memory of 2852	3428	95
PID 3428 wrote to memory of 5016	3428	96
PID 3428 wrote to memory of 5016	3428	96
PID 3428 wrote to memory of 2760	3428	97
PID 3428 wrote to memory of 2760	3428	97
PID 3428 wrote to memory of 3916	3428	98
PID 3428 wrote to memory of 3916	3428	98
PID 3428 wrote to memory of 4828	3428	99
PID 3428 wrote to memory of 4828	3428	99
PID 3428 wrote to memory of 632	3428	100
PID 3428 wrote to memory of 632	3428	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\a20721654c3fced2cf5ecc9bed5fd3a3_JaffaCakes118.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:2852

C:\Users\Admin\AppData\Local\O3qx\slui.exe
C:\Users\Admin\AppData\Local\O3qx\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:5016

C:\Windows\system32\msra.exe
C:\Windows\system32\msra.exe
1⤵
PID:2760

C:\Users\Admin\AppData\Local\Xmnu8CdH\msra.exe
C:\Users\Admin\AppData\Local\Xmnu8CdH\msra.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3916

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
1⤵
PID:4828

C:\Users\Admin\AppData\Local\7lWqO\SystemPropertiesDataExecutionPrevention.exe
C:\Users\Admin\AppData\Local\7lWqO\SystemPropertiesDataExecutionPrevention.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\7lWqO\SYSDM.CPL

Filesize
1.2MB

MD5
2d08559edfe0940affb5e80da5811e71

SHA1
2c7dc161e0844e959a7e033cf17891f680538311

SHA256
a9001dbba812e49b20a593597c4ec87d935cd4ee086ce42d56434f0a5b585dc6

SHA512
d825f973cd8d9b5cd392ad2bea7a9713693f646c594c0edbecdcd4ab8fe6b0f4f6517a7766adc03e9a06a95186049e36e9a335b2ce62b02c0805242db762cf22

Download Submit
C:\Users\Admin\AppData\Local\7lWqO\SystemPropertiesDataExecutionPrevention.exe

Filesize
82KB

MD5
de58532954c2704f2b2309ffc320651d

SHA1
0a9fc98f4d47dccb0b231edf9a63309314f68e3b

SHA256
1f810658969560f6e7d7a14f71d1196382e53b984ca190fa9b178ac4a32acfb3

SHA512
d4d57cc30d9079f4e9193ba42631e8e53d86b22e9c655d7a8c25e5be0e5e1d6dfff4714ddc23e3e392809d623b4f8d43c63893f74c325fc77459ac03c7a451ed

Download Submit
C:\Users\Admin\AppData\Local\O3qx\WINBRAND.dll

Filesize
1.2MB

MD5
749fff174e528e1e4509061c859de73f

SHA1
7fd38291c926c9ad40e8a9a1a9a3cf940b91217c

SHA256
5ad67f557534ab2b5eb8dbe768d53a014305d7030003d59082a511d0df1a4e9f

SHA512
81d64faef0644c6c6c3af30f1447750eaf81817cbec048fc85504561b317af97a7c0a6af54a96e97505daa25131b3b4decac4b0e466493c8fb30b869c8b0c874

Download Submit
C:\Users\Admin\AppData\Local\O3qx\slui.exe

Filesize
534KB

MD5
eb725ea35a13dc18eac46aa81e7f2841

SHA1
c0b3304c970324952e18c4a51073e3bdec73440b

SHA256
25e7624d469a592934ab8c509d12c153c2799e604c2a4b8a83650a7268577dff

SHA512
39192a1fad29654b3769f007298eff049d0688a3cb51390833ec563f44f9931cd3f6f8693db37b649b061b5aab379b166c15dade56d0fc414375243320375b26

Download Submit
C:\Users\Admin\AppData\Local\Xmnu8CdH\UxTheme.dll

Filesize
1.2MB

MD5
1e2c6f94e7932c7f2c7b195e7bd6d9a5

SHA1
4106f65bae93c90b1d47c62088ff9a27f4de0ef3

SHA256
80135ddcc40d824952777a3ed45004ef793f1a16163ff3da37f8fe2304658939

SHA512
f65affbdc4f6ed9f92d665ac8164e8b116f55c26f50a77d9f6128c55739a93a95af1fc93645f8d314a5674e0bd70d3c7b1f875a4c9c074fad80b6ec8adf76b3b

Download Submit
C:\Users\Admin\AppData\Local\Xmnu8CdH\msra.exe

Filesize
579KB

MD5
dcda3b7b8eb0bfbccb54b4d6a6844ad6

SHA1
316a2925e451f739f45e31bc233a95f91bf775fa

SHA256
011e1decd6683afe5f1e397fe9697f2cf592ae21766a7629e234682f721658ae

SHA512
18e8c99f8b86375627aba0d2b10cf4db24ee5ac61a3d6a73d382a83ec63217c7e455570d4fa7dcdbb188dcc73988689661f8cab2337ae8c615fa6bc9a08f71f5

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Pvdelpvduyz.lnk

Filesize
1KB

MD5
45e949224489066b79280346a43c70bc

SHA1
4c50439a23af663a3a0e01a993fdfec4f18c31e9

SHA256
4bf3e2af8386f12a7f7384a9a6402706d21ae8b07780b549c3123b2f93890419

SHA512
c60130d002fb80cc2baaf9dd7db10318e74fd040227ad2c4b630c50d2d9f6da3875699bcc87389f23cf4a99a9f54309628f9d9234863976006c1fb83aebe1d0e

Download Submit
memory/632-85-0x00007FFD61FA0000-0x00007FFD620D2000-memory.dmp

Filesize
1.2MB

Download
memory/3428-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-36-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-17-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-13-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-4-0x0000000007440000-0x0000000007441000-memory.dmp

Filesize
4KB

Download
memory/3428-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-6-0x00007FFD7F79A000-0x00007FFD7F79B000-memory.dmp

Filesize
4KB

Download
memory/3428-30-0x00000000045C0000-0x00000000045C7000-memory.dmp

Filesize
28KB

Download
memory/3428-25-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3428-31-0x00007FFD7FDD0000-0x00007FFD7FDE0000-memory.dmp

Filesize
64KB

Download
memory/3520-39-0x00007FFD70EB0000-0x00007FFD70FE1000-memory.dmp

Filesize
1.2MB

Download
memory/3520-3-0x00000000020C0000-0x00000000020C7000-memory.dmp

Filesize
28KB

Download
memory/3520-0-0x00007FFD70EB0000-0x00007FFD70FE1000-memory.dmp

Filesize
1.2MB

Download
memory/3916-63-0x00007FFD61270000-0x00007FFD613A2000-memory.dmp

Filesize
1.2MB

Download
memory/3916-66-0x0000028F377F0000-0x0000028F377F7000-memory.dmp

Filesize
28KB

Download
memory/3916-69-0x00007FFD61270000-0x00007FFD613A2000-memory.dmp

Filesize
1.2MB

Download
memory/5016-52-0x00007FFD61FA0000-0x00007FFD620D2000-memory.dmp

Filesize
1.2MB

Download
memory/5016-47-0x00007FFD61FA0000-0x00007FFD620D2000-memory.dmp

Filesize
1.2MB

Download
memory/5016-46-0x000001F444040000-0x000001F444047000-memory.dmp

Filesize
28KB

Download