dridex | 3c08465a1453b7ae0a91858ca433f0670e11e769daaff2dd43cac6edc3fc0479

Analysis

max time kernel
72s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2024, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Report-24Sept.2020.scr
Size 734KB
Sample240817-xcvqbstdnl
SHA256 fad001d463e892e7844040cabdcfa8f8431c07e7ef1ffd76ffbd190f49d7693d
MD5 d594e8a2098a81c9bfa24f3c17c992e6
SHA1 b9c820973407c7b4bef5b9ce98b7af62cafa397d
SHA512 50049d1ded3f8cfcb6aa839c0341e91bb39b46dbd5376533f2725ce27e6ae5059d3f5af71100dd025b03b7a3cf90bfa920a93818ac1bafb30c65460514c4fd47
SSDEEP 12288:EY20AljdZgBPfKfi1leppjfQxAogJfqsUsz0cX0rLfGLEXTMd8MQ5B5rxVCz:Z20gPgFKLfQxAVBbIcXQGL+MWMwTrxMz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

dridex 10555 botnet discovery evasion

Malware Config

Extracted

Family

dridex

Botnet

10555

151.236.219.181:443
142.4.6.57:14043
162.144.127.197:3786
103.40.116.68:5443

rc4.plain

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
848	attrib.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	Report-24Sept.2020.scr
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2216	PLS.exe

Loads dropped DLL 1 IoCs

pid	Process
4980	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Report-24Sept.2020.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PLS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
1796	timeout.exe
4684	timeout.exe
1756	timeout.exe
1348	timeout.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	Report-24Sept.2020.scr
Key created	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000_Classes\Local Settings	cmd.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 4168	3196	Report-24Sept.2020.scr	85
PID 3196 wrote to memory of 4168	3196	Report-24Sept.2020.scr	85
PID 3196 wrote to memory of 4168	3196	Report-24Sept.2020.scr	85
PID 4168 wrote to memory of 1920	4168	WScript.exe	87
PID 4168 wrote to memory of 1920	4168	WScript.exe	87
PID 4168 wrote to memory of 1920	4168	WScript.exe	87
PID 1920 wrote to memory of 1796	1920	cmd.exe	90
PID 1920 wrote to memory of 1796	1920	cmd.exe	90
PID 1920 wrote to memory of 1796	1920	cmd.exe	90
PID 1920 wrote to memory of 2216	1920	cmd.exe	92
PID 1920 wrote to memory of 2216	1920	cmd.exe	92
PID 1920 wrote to memory of 2216	1920	cmd.exe	92
PID 1920 wrote to memory of 4684	1920	cmd.exe	93
PID 1920 wrote to memory of 4684	1920	cmd.exe	93
PID 1920 wrote to memory of 4684	1920	cmd.exe	93
PID 1920 wrote to memory of 3444	1920	cmd.exe	98
PID 1920 wrote to memory of 3444	1920	cmd.exe	98
PID 1920 wrote to memory of 3444	1920	cmd.exe	98
PID 1920 wrote to memory of 1756	1920	cmd.exe	99
PID 1920 wrote to memory of 1756	1920	cmd.exe	99
PID 1920 wrote to memory of 1756	1920	cmd.exe	99
PID 3444 wrote to memory of 3412	3444	WScript.exe	100
PID 3444 wrote to memory of 3412	3444	WScript.exe	100
PID 3444 wrote to memory of 3412	3444	WScript.exe	100
PID 3412 wrote to memory of 848	3412	cmd.exe	102
PID 3412 wrote to memory of 848	3412	cmd.exe	102
PID 3412 wrote to memory of 848	3412	cmd.exe	102
PID 3412 wrote to memory of 1348	3412	cmd.exe	103
PID 3412 wrote to memory of 1348	3412	cmd.exe	103
PID 3412 wrote to memory of 1348	3412	cmd.exe	103
PID 3412 wrote to memory of 4980	3412	cmd.exe	105
PID 3412 wrote to memory of 4980	3412	cmd.exe	105
PID 3412 wrote to memory of 4980	3412	cmd.exe	105

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
848	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Report-24Sept.2020.scr
"C:\Users\Admin\AppData\Local\Temp\Report-24Sept.2020.scr" /S
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\XIU\configurate\selector.vbs" /f=CREATE_NO_WINDOW install.cmd
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\XIU\configurate\dsep.bat" "
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1920
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 3
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1796
  - - C:\XIU\configurate\PLS.exe
      "PLS.exe" e -pVersion hl.rar
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2216
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:4684
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\XIU\configurate\fatless.vbs"
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\XIU\configurate\lll.bat" "
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3412
      - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h "C:\XIU"
        6⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:848
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1348
      - C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 -s CONFIG.dll
        6⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4980
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 4
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CONFIG.dll

Path C:\XIU\configurate\CONFIG.dll
Size 324KB
SHA256 9492c6842475059a6af7f4b8c42e03944f08938243fa393713a5a6a930d79bcd
MD5 031f318c8ab815cda0d447904a925cf7
SHA1 2bbca22cb0355f1ad4acedd9dd69ebaaeddf6b9e
SHA512 519a54859e82861cf3f73b3a6ac400b57bd560a53867b8396aa8c286a5ee4e675c75c3f80ddc0cb4e0ef80300ada6b4e985bd4bb73bdc8d1c56a673240a83c4d
SSDEEP 6144:m7fWXIrEU401YJpdX9IPS/AE8ZqJ5kHXBB0X3v8HoFS:m7fMUF1YJjX9fZ8ZmgE3Gx
MD5 SHA1 SHA512 SSDEEP

Submit Download

PLS.exe

Path C:\XIU\configurate\PLS.exe
Size 551KB
SHA256 34dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
MD5 061f64173293969577916832be29b90d
SHA1 b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA512 66e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da
SSDEEP 6144:lEFCsTIKlyUvQLPSvsN6UeLrfeH9Kv526R7mO/ak/QXcBgWxJiT40/abdBZAuO8U:SsDKl7omvhpr10Oj3xgTh/arNnaGcF
MD5 SHA1 SHA512 SSDEEP

Submit Download

SLP.txt

Path C:\XIU\configurate\SLP.txt
Size 212KB
SHA256 6740389c8266848199851648c4228df7401dd30c8dec89ab7827f1bec7ab522b
MD5 24fdf4791a3efa0178e677b0e03c12b1
SHA1 f5f45b8c35cf303eff77aa1fbe02e9bd4318c7d7
SHA512 f9b71717cdd61a9539dd93267f4d039e0de7dd8933b9f63679466a881884b06ccdc666d27bb6b9909127101a63879b33a1165a83fff9d6ce3009ed5e7b97b6da
SSDEEP 6144:eLzpWgv530L3EXTMdDKh1G0MrQ5BzXGirxV6XK:eLfGLEXTMd8MQ5B5rxVCK
MD5 SHA1 SHA512 SSDEEP

Submit Download

dsep.bat

Path C:\XIU\configurate\dsep.bat
Size 569B
SHA256 db74d354ad34fa9a0dafd9b846574855b480590ebf06879d87844060cf50ff4b
MD5 9318a04c2d4d80719382a7e73c28736b
SHA1 ddb5096d2841b575a941ecaf79fee8e2365563ae
SHA512 0dd33ebf730e77a1d55996b14a560f1584e17e55e5a6efdedd3bce2ecdd0e7f892c9ae2b4bef8ee68a723ef9d02717e9f9fb3939f1b95cacaeacd29b28e70717
MD5 SHA1 SHA512

Submit Download

fatless.vbs

Path C:\XIU\configurate\fatless.vbs
Size 99B
SHA256 06d4a788d4c91c141b933199826ac3b4df8d6027f818fc2b198043773ea132e4
MD5 75214af723ca4720e0aa365eb3ef6f5b
SHA1 a6b73a92246cd3b857e32e2a8a26ee8fc52fdcb4
SHA512 91b7752a63e694641f17187cdb8e1a7876eda195f3070d6fee210b6210e2897833bc08b770db6e82cfec7a99e3fae5c01588872eb2aa60dccdc4064363f54c58
MD5 SHA1 SHA512

Submit Download

lll.bat

Path C:\XIU\configurate\lll.bat
Size 692B
SHA256 b449d3d5b476b1a53bbe6b5d6fef93e89d8456450e84b1c349237c6a8df3b65d
MD5 70c1b14895a29502d3e94e395606f82d
SHA1 a02fff1f3a0c1c8ff5453a5de715cbe5ba227185
SHA512 8f9a8975124738b7a5ad1e0d92549f45a06c6efa8fac7d3c07ce16399a6aeed5644c14bf56cec56c83a293835cfb994a99d3e75dc5e9ea7f41e9e354760f742c
MD5 SHA1 SHA512

Submit Download

selector.vbs

Path C:\XIU\configurate\selector.vbs
Size 82B
SHA256 332462b21eed1bcbd9c198851e28b789893628410e7268ddc022a40e2f7f94c1
MD5 9cce3084f1850c3be989cc47fab4ee71
SHA1 e490f01a46f85c155c2848affda6d2c7b0791c8b
SHA512 30cc59e8e1a5b20a1c59bb437dc96cf65f7bbfa798617a77a613ae89012be78bda38c51278411ba511a7058eaca728e160a0d6d29f5defaeafa4dc7f64458f88
MD5 SHA1 SHA512

Submit Download

memory/4980-26-0x0000000073390000-0x00000000733E1000-memory.dmp

Download

memory/4980-28-0x0000000073390000-0x00000000733E1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads