dridex | b60a23eefd0b5d0fd235560023c71b4370ebd54e66785b7d30647e974ff29ada

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 18:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac0d85bfe7f5dfb252cbd397cf450e04_JaffaCakes118.dll
Size

1.2MB
MD5

ac0d85bfe7f5dfb252cbd397cf450e04
SHA1

c0b7faa33688049c254764a8b918a7643ed1205c
SHA256

b60a23eefd0b5d0fd235560023c71b4370ebd54e66785b7d30647e974ff29ada
SHA512

f6bff5dc86b31140b866b443c9a26f40b907f737611b9a08b70de894a7b3d97d82040d8014071ddc3b6f12c0a83bf053555d1918b1f184bb6b35d3838a0e4d6d
SSDEEP

24576:muYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:G9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3400-4-0x0000000007430000-0x0000000007431000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

perfmon.exedpapimig.exeisoburn.exe

pid	Process
3140	perfmon.exe
3508	dpapimig.exe
1644	isoburn.exe

Loads dropped DLL 3 IoCs

Processes:

perfmon.exedpapimig.exeisoburn.exe

pid	Process
3140	perfmon.exe
3508	dpapimig.exe
1644	isoburn.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wbdoaalrz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\AccountPictures\\IiLEDVF\\dpapimig.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeperfmon.exedpapimig.exeisoburn.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	perfmon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dpapimig.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	isoburn.exe

Modifies registry class 3 IoCs

Processes:

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\
Key created	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
4900	rundll32.exe
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400
3400

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

description	pid	Process
Token: SeShutdownPrivilege	3400
Token: SeCreatePagefilePrivilege	3400
Token: SeShutdownPrivilege	3400
Token: SeCreatePagefilePrivilege	3400
Token: SeShutdownPrivilege	3400
Token: SeCreatePagefilePrivilege	3400
Token: SeShutdownPrivilege	3400
Token: SeCreatePagefilePrivilege	3400

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid	Process
3400
3400

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid	Process
3400

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	procid_target
PID 3400 wrote to memory of 3748	3400	95
PID 3400 wrote to memory of 3748	3400	95
PID 3400 wrote to memory of 3140	3400	96
PID 3400 wrote to memory of 3140	3400	96
PID 3400 wrote to memory of 4292	3400	97
PID 3400 wrote to memory of 4292	3400	97
PID 3400 wrote to memory of 3508	3400	98
PID 3400 wrote to memory of 3508	3400	98
PID 3400 wrote to memory of 4396	3400	99
PID 3400 wrote to memory of 4396	3400	99
PID 3400 wrote to memory of 1644	3400	100
PID 3400 wrote to memory of 1644	3400	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ac0d85bfe7f5dfb252cbd397cf450e04_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4900

C:\Windows\system32\perfmon.exe
C:\Windows\system32\perfmon.exe
1⤵
PID:3748

C:\Users\Admin\AppData\Local\SqSG\perfmon.exe
C:\Users\Admin\AppData\Local\SqSG\perfmon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3140

C:\Windows\system32\dpapimig.exe
C:\Windows\system32\dpapimig.exe
1⤵
PID:4292

C:\Users\Admin\AppData\Local\Zsq49FEeD\dpapimig.exe
C:\Users\Admin\AppData\Local\Zsq49FEeD\dpapimig.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3508

C:\Windows\system32\isoburn.exe
C:\Windows\system32\isoburn.exe
1⤵
PID:4396

C:\Users\Admin\AppData\Local\oYzApe\isoburn.exe
C:\Users\Admin\AppData\Local\oYzApe\isoburn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SqSG\credui.dll

Filesize
1.2MB

MD5
1e556186629c94085ef9a1400b0bdbeb

SHA1
ecea0e18c96b2422726ee69f09afc582ec5a9e07

SHA256
1365872210d2d9b707a03ec157c3795ba1c95aa4f164c004de2a2b25188dbf7d

SHA512
1183fd7e5e18b22508414f7f2feb778c34da5ec87966c03f6333ccc785eba65875bcba7b7682135620793637da9803d785ef263bc0a9636a18f07203b2344e7a

Download Submit
C:\Users\Admin\AppData\Local\SqSG\perfmon.exe

Filesize
177KB

MD5
d38aa59c3bea5456bd6f95c73ad3c964

SHA1
40170eab389a6ba35e949f9c92962646a302d9ef

SHA256
5f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c

SHA512
59fa552a46e5d6237c7244b03d09d60e9489217b4319a212e822c73fe1f31a81837cb906ae7da92072bd3d9263fe0b967e073110ba81da3a90126f25115fff68

Download Submit
C:\Users\Admin\AppData\Local\Zsq49FEeD\DUI70.dll

Filesize
1.4MB

MD5
519a1cf212cf45c7f52a96453430aa36

SHA1
02f0bc146e3414e8d8d8e28b67e88f296d8bf347

SHA256
42d37c85630473b9efa0191e5c76313e2f13bf0ca376cded7c4f53265ecf2062

SHA512
76cafe07a1e29cd151354dc4c4986c0d84a313a18cef2c54ff75e4b8b2dfd31248852c8b2b7392da8af2906aa4aba88327f2de9e669989f02f4fbd01f65f868c

Download Submit
C:\Users\Admin\AppData\Local\Zsq49FEeD\dpapimig.exe

Filesize
76KB

MD5
b6d6477a0c90a81624c6a8548026b4d0

SHA1
e6eac6941d27f76bbd306c2938c0a962dbf1ced1

SHA256
a8147d08b82609c72d588a0a604cd3c1f2076befcc719d282c7cbd6525ae89eb

SHA512
72ec8b79e3438f0f981129a323ad39db84df7dd14a796a820bdbc74ea8fa13eee843d1ea030a0c1caeda2e2d69952f14a821a73825b38dd9415047aca597b1fe

Download Submit
C:\Users\Admin\AppData\Local\oYzApe\UxTheme.dll

Filesize
1.2MB

MD5
67c49d06607553618777e147fc0523a8

SHA1
79b97ec89b2417f010d9fa0e092d8d965dd1c487

SHA256
f89f9dcb5c9b73ecdc4101b6571b9552db99d47a1482b378757dfadc414ce58b

SHA512
5eee25ffa822f1891798498a74c1bbc581fc15289619932121fbeb1f53a181a14210842320302615dffd9ce379ed6279f3285904482dfc7fe28480270e603e5d

Download Submit
C:\Users\Admin\AppData\Local\oYzApe\isoburn.exe

Filesize
119KB

MD5
68078583d028a4873399ae7f25f64bad

SHA1
a3c928fe57856a10aed7fee17670627fe663e6fe

SHA256
9478c095afe212bce91d2de1a3c3647109f2d54e46b9bf70843e839324458567

SHA512
25503a47c53fe83eeb56726b5a5eec5cb01bc783e866306f92242a7a8cbafa20a3209217e0f4561febfec78d2f64f1725727a6b2d3ee6da512618984d0bb0bc1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mihblavoyj.lnk

Filesize
1KB

MD5
b7b696e3d122ee6792c58d79750fdbea

SHA1
e89145067d5e31ae0e34f5f0e5ddaa9203439c89

SHA256
b5592201720fe3bf8671cc88d255ea1294f34da36267f5e6e8aeb1fac355677b

SHA512
a471fabe8c1b0adf25672c517a8b184f3d9663769550c5635700169c02892b2a63ed11611df60b6a9b52788580f28d2f31c7e7a151bff904007d0d07ba1fd6c6

Download Submit
memory/1644-86-0x00007FFA7C2F0000-0x00007FFA7C422000-memory.dmp

Filesize
1.2MB

Download
memory/1644-83-0x0000020920920000-0x0000020920927000-memory.dmp

Filesize
28KB

Download
memory/3140-52-0x00007FFA7C2F0000-0x00007FFA7C422000-memory.dmp

Filesize
1.2MB

Download
memory/3140-47-0x00007FFA7C2F0000-0x00007FFA7C422000-memory.dmp

Filesize
1.2MB

Download
memory/3140-46-0x00000164F2EB0000-0x00000164F2EB7000-memory.dmp

Filesize
28KB

Download
memory/3400-18-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-6-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-4-0x0000000007430000-0x0000000007431000-memory.dmp

Filesize
4KB

Download
memory/3400-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-13-0x00007FFA9821A000-0x00007FFA9821B000-memory.dmp

Filesize
4KB

Download
memory/3400-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-30-0x0000000003130000-0x0000000003137000-memory.dmp

Filesize
28KB

Download
memory/3400-34-0x00007FFA99AD0000-0x00007FFA99AE0000-memory.dmp

Filesize
64KB

Download
memory/3400-25-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3400-36-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/3508-69-0x00007FFA7C2B0000-0x00007FFA7C427000-memory.dmp

Filesize
1.5MB

Download
memory/3508-64-0x00007FFA7C2B0000-0x00007FFA7C427000-memory.dmp

Filesize
1.5MB

Download
memory/3508-63-0x0000019F6FC20000-0x0000019F6FC27000-memory.dmp

Filesize
28KB

Download
memory/4900-0-0x00000152D8A80000-0x00000152D8A87000-memory.dmp

Filesize
28KB

Download
memory/4900-39-0x00007FFA8B4B0000-0x00007FFA8B5E1000-memory.dmp

Filesize
1.2MB

Download
memory/4900-1-0x00007FFA8B4B0000-0x00007FFA8B5E1000-memory.dmp

Filesize
1.2MB

Download