dridex | 0a5a9a825cdb713862e4db1eeea33b8847e231cc54197c9b4b7b958c70e9c253

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
22-08-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b612fd6158326f6573d2c195218b4187_JaffaCakes118.dll
Size

1.2MB
MD5

b612fd6158326f6573d2c195218b4187
SHA1

8a784d8434dc4ee8a185038e55beeae77169be6e
SHA256

0a5a9a825cdb713862e4db1eeea33b8847e231cc54197c9b4b7b958c70e9c253
SHA512

41fa451ca8ff1d805fa5407174fa0e59a6468017a91a3f2b2a0db6b84cbd26573bbce4788ead48c3fc41e40313886c2ef2237a6e99a9f41b710cf344ba1cb47a
SSDEEP

24576:buYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:F9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1196-5-0x0000000002E30000-0x0000000002E31000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

WindowsAnytimeUpgradeResults.exespinstall.exeRDVGHelper.exe

pid	Process
2176	WindowsAnytimeUpgradeResults.exe
600	spinstall.exe
2984	RDVGHelper.exe

Loads dropped DLL 7 IoCs

Processes:

WindowsAnytimeUpgradeResults.exespinstall.exeRDVGHelper.exe

pid	Process
1196
2176	WindowsAnytimeUpgradeResults.exe
1196
600	spinstall.exe
1196
2984	RDVGHelper.exe
1196

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tlngny = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\KbA\\spinstall.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeWindowsAnytimeUpgradeResults.exespinstall.exeRDVGHelper.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsAnytimeUpgradeResults.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spinstall.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RDVGHelper.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
2272	rundll32.exe
2272	rundll32.exe
2272	rundll32.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	procid_target
PID 1196 wrote to memory of 2680	1196	30
PID 1196 wrote to memory of 2680	1196	30
PID 1196 wrote to memory of 2680	1196	30
PID 1196 wrote to memory of 2176	1196	31
PID 1196 wrote to memory of 2176	1196	31
PID 1196 wrote to memory of 2176	1196	31
PID 1196 wrote to memory of 2104	1196	33
PID 1196 wrote to memory of 2104	1196	33
PID 1196 wrote to memory of 2104	1196	33
PID 1196 wrote to memory of 600	1196	34
PID 1196 wrote to memory of 600	1196	34
PID 1196 wrote to memory of 600	1196	34
PID 1196 wrote to memory of 2708	1196	35
PID 1196 wrote to memory of 2708	1196	35
PID 1196 wrote to memory of 2708	1196	35
PID 1196 wrote to memory of 2984	1196	36
PID 1196 wrote to memory of 2984	1196	36
PID 1196 wrote to memory of 2984	1196	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b612fd6158326f6573d2c195218b4187_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2272

C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
1⤵
PID:2680

C:\Users\Admin\AppData\Local\MyjCk\WindowsAnytimeUpgradeResults.exe
C:\Users\Admin\AppData\Local\MyjCk\WindowsAnytimeUpgradeResults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2176

C:\Windows\system32\spinstall.exe
C:\Windows\system32\spinstall.exe
1⤵
PID:2104

C:\Users\Admin\AppData\Local\9sHjR\spinstall.exe
C:\Users\Admin\AppData\Local\9sHjR\spinstall.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:600

C:\Windows\system32\RDVGHelper.exe
C:\Windows\system32\RDVGHelper.exe
1⤵
PID:2708

C:\Users\Admin\AppData\Local\3c29FQgk\RDVGHelper.exe
C:\Users\Admin\AppData\Local\3c29FQgk\RDVGHelper.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\3c29FQgk\WTSAPI32.dll

Filesize
1.2MB

MD5
30f512ff4c3dc43d8a90e7ba31d138e9

SHA1
55e8785a9443bc1c78499ae37600e7b43bd56a02

SHA256
b7c0f6e81cea7b9be8c7aec65821e361131c79902dd3bf2e3c49eb2b4dcde301

SHA512
09fabfa4e238ac76a1dc33078cd3ffa16e8d0ec0b02f1985ac2e3954f7b5d6d5c73df6e813adcb1db3588505de485c33156c3f82a377b76715e904630ef81ddb

Download Submit
C:\Users\Admin\AppData\Local\9sHjR\XmlLite.dll

Filesize
1.2MB

MD5
56fcaadcc3dc82cfcba9fb5eec330cf1

SHA1
6e6af638ad6a91a76c0227c159b889ebc1fa6982

SHA256
fc8f952a03a44ec4d5fab1a6488e73bba3150b679b7738440e06f45df475669e

SHA512
71d00b5307f9db39bb2408dc84ce43cf76b0ee381819faba7f033dcfcdc102b24ed0aca8728073432a08ff79492cf3e1288f3c875d2e4335c21cbd4af49f08d3

Download Submit
C:\Users\Admin\AppData\Local\MyjCk\WINBRAND.dll

Filesize
1.2MB

MD5
95fb7f7b7c9f37ae3fb512c3a254753d

SHA1
322c3e58d06a3f200d70ba1bf34f40be02ec9be4

SHA256
0e4aa4880db53c67f0fef008de0762a69933b347b4697de990245345a1e85b25

SHA512
616bd6583ca721472c77045ae7dc4281ce999aa700ee5812a1581dc73b2b7f72a07b5297c2dcdd8467f9d90d24d9ff00b8dbd2fcb13e3c34df6f5d2909ee562a

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mityoyoyxpr.lnk

Filesize
1KB

MD5
70f0bffa0a65bb31dd9a4b12394da09a

SHA1
0d592f9116c2fb910606c9147ec0fd64eef1e13c

SHA256
bef323ecc5295547629fba74c963106bf2f7b9cd6fd4d94bbaf60797eeeda2ca

SHA512
922fdb6e6f1b5b0d03bd7f215268f42b3537b39d1c7b57265c56f6107d50a9ec8d11b28cada9f6649da6381f3e200f3b8a605e9868b6e2f2d9f89f48e57db670

Download Submit
\Users\Admin\AppData\Local\3c29FQgk\RDVGHelper.exe

Filesize
93KB

MD5
53fda4af81e7c4895357a50e848b7cfe

SHA1
01fb2d0210f1c47aaf684e31a9fb78f89bba9c0f

SHA256
62ab8c2c5b5bd84fd07e96b6a3b87a4ea56946107ed9b7f8076580ae1fefd038

SHA512
dbbda90a57d27160c5a3a5e4e94cfc43b1663fcbfe424fdec851e52356f61492bdcf677c46be8aa4e8ccc8be7c389b6aa7bbbce8447e1fae32f03e5e409f4051

Download Submit
\Users\Admin\AppData\Local\9sHjR\spinstall.exe

Filesize
584KB

MD5
29c1d5b330b802efa1a8357373bc97fe

SHA1
90797aaa2c56fc2a667c74475996ea1841bc368f

SHA256
048bd22abf158346ab991a377cc6e9d2b20b4d73ccee7656c96a41f657e7be7f

SHA512
66f4f75a04340a1dd55dfdcc3ff1103ea34a55295f56c12e88d38d1a41e5be46b67c98bd66ac9f878ce79311773e374ed2bce4dd70e8bb5543e4ec1dd56625ee

Download Submit
\Users\Admin\AppData\Local\MyjCk\WindowsAnytimeUpgradeResults.exe

Filesize
288KB

MD5
6f3f29905f0ec4ce22c1fd8acbf6c6de

SHA1
68bdfefe549dfa6262ad659f1578f3e87d862773

SHA256
e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b

SHA512
16a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e

Download Submit
memory/600-78-0x000007FEF6670000-0x000007FEF67A1000-memory.dmp

Filesize
1.2MB

Download
memory/600-72-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/600-73-0x000007FEF6670000-0x000007FEF67A1000-memory.dmp

Filesize
1.2MB

Download
memory/1196-12-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-9-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-25-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-16-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-15-0x0000000002D90000-0x0000000002D97000-memory.dmp

Filesize
28KB

Download
memory/1196-11-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-26-0x00000000775F1000-0x00000000775F2000-memory.dmp

Filesize
4KB

Download
memory/1196-27-0x0000000077780000-0x0000000077782000-memory.dmp

Filesize
8KB

Download
memory/1196-36-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-37-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-4-0x00000000773E6000-0x00000000773E7000-memory.dmp

Filesize
4KB

Download
memory/1196-46-0x00000000773E6000-0x00000000773E7000-memory.dmp

Filesize
4KB

Download
memory/1196-13-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-5-0x0000000002E30000-0x0000000002E31000-memory.dmp

Filesize
4KB

Download
memory/1196-8-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-14-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-17-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-10-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-7-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/2176-60-0x000007FEF6D00000-0x000007FEF6E31000-memory.dmp

Filesize
1.2MB

Download
memory/2176-55-0x000007FEF6D00000-0x000007FEF6E31000-memory.dmp

Filesize
1.2MB

Download
memory/2176-54-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2272-0-0x000007FEF6680000-0x000007FEF67B0000-memory.dmp

Filesize
1.2MB

Download
memory/2272-45-0x000007FEF6680000-0x000007FEF67B0000-memory.dmp

Filesize
1.2MB

Download
memory/2272-3-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2984-90-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2984-96-0x000007FEF6670000-0x000007FEF67A1000-memory.dmp

Filesize
1.2MB

Download