dridex | 7e4e5b66b159d527d7f95083f708b94777aad062e5e665f3a41eb07d7891a60e

Analysis

max time kernel
150s
max time network
126s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
25-08-2024 08:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c0531aa81daf874d07f3ac24ce59d4f1_JaffaCakes118.dll
Size

1.2MB
MD5

c0531aa81daf874d07f3ac24ce59d4f1
SHA1

8aa0b1e290bf9b4335a8448989910b1f9827157e
SHA256

7e4e5b66b159d527d7f95083f708b94777aad062e5e665f3a41eb07d7891a60e
SHA512

abc190f52bc1e5f0a0368ac6f830254054cc5e574614c803cde4534887ee5e1e2387878ac0d72dc17fd121293815bbd29c29b34a077a2726b11b69a78b17666e
SSDEEP

24576:PuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:x9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1196-5-0x0000000002910000-0x0000000002911000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2656	shrpubw.exe
1296	SystemPropertiesDataExecutionPrevention.exe
2028	mfpmp.exe

Loads dropped DLL 7 IoCs

pid	Process
1196	Process not Found
2656	shrpubw.exe
1196	Process not Found
1296	SystemPropertiesDataExecutionPrevention.exe
1196	Process not Found
2028	mfpmp.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Madzpveq = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\MAINTE~1\\JYxwU\\SYSTEM~1.EXE"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	shrpubw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesDataExecutionPrevention.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2256	rundll32.exe
2256	rundll32.exe
2256	rundll32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2880	1196	Process not Found	30
PID 1196 wrote to memory of 2880	1196	Process not Found	30
PID 1196 wrote to memory of 2880	1196	Process not Found	30
PID 1196 wrote to memory of 2656	1196	Process not Found	31
PID 1196 wrote to memory of 2656	1196	Process not Found	31
PID 1196 wrote to memory of 2656	1196	Process not Found	31
PID 1196 wrote to memory of 2328	1196	Process not Found	32
PID 1196 wrote to memory of 2328	1196	Process not Found	32
PID 1196 wrote to memory of 2328	1196	Process not Found	32
PID 1196 wrote to memory of 1296	1196	Process not Found	33
PID 1196 wrote to memory of 1296	1196	Process not Found	33
PID 1196 wrote to memory of 1296	1196	Process not Found	33
PID 1196 wrote to memory of 1504	1196	Process not Found	34
PID 1196 wrote to memory of 1504	1196	Process not Found	34
PID 1196 wrote to memory of 1504	1196	Process not Found	34
PID 1196 wrote to memory of 2028	1196	Process not Found	35
PID 1196 wrote to memory of 2028	1196	Process not Found	35
PID 1196 wrote to memory of 2028	1196	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c0531aa81daf874d07f3ac24ce59d4f1_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2256

C:\Windows\system32\shrpubw.exe
C:\Windows\system32\shrpubw.exe
1⤵
PID:2880

C:\Users\Admin\AppData\Local\J970x\shrpubw.exe
C:\Users\Admin\AppData\Local\J970x\shrpubw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2656

C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
C:\Windows\system32\SystemPropertiesDataExecutionPrevention.exe
1⤵
PID:2328

C:\Users\Admin\AppData\Local\R1u6IZ\SystemPropertiesDataExecutionPrevention.exe
C:\Users\Admin\AppData\Local\R1u6IZ\SystemPropertiesDataExecutionPrevention.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1296

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:1504

C:\Users\Admin\AppData\Local\YV8kdzAr\mfpmp.exe
C:\Users\Admin\AppData\Local\YV8kdzAr\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\J970x\MFC42u.dll

Filesize
1.2MB

MD5
f9f48e30f5bdd087ea9be50d9606bf20

SHA1
c954fd05892d4d322d62faca0212efd368899e81

SHA256
98cf42eee05e38827b1769eb995f0ae40b3145bea38d2ff7821e1ad308172708

SHA512
9e4d7cb08c5c5391837ac323d61f8799d68f4768f12a480e3720363e15219c7adc4d5d24da95a427d1206aba00f0e5a2a8ae13cd9126723df2617d69d251a9fb

Download Submit
C:\Users\Admin\AppData\Local\J970x\shrpubw.exe

Filesize
398KB

MD5
29e6d0016611c8f948db5ea71372f76c

SHA1
01d007a01020370709cd6580717f9ace049647e8

SHA256
53c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930

SHA512
300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4

Download Submit
C:\Users\Admin\AppData\Local\R1u6IZ\SYSDM.CPL

Filesize
1.2MB

MD5
01568164edf320041cefbc10456c71df

SHA1
559f10c325e01de4c9375e0a6a3c51dc2a2d4cb3

SHA256
5eb332db6dc0020c61b7ea4f484220e704909b6d51cadd0a9ae4eb583cfe5e48

SHA512
32cc988863147e6a86688cdcb9bbadffc9015c88f84a96684ab2529fdc8aec04d70499b0e4ca3c118f3971f5845ff044e294f875a780773de762a4260307951c

Download Submit
C:\Users\Admin\AppData\Local\R1u6IZ\SystemPropertiesDataExecutionPrevention.exe

Filesize
80KB

MD5
e43ff7785fac643093b3b16a9300e133

SHA1
a30688e84c0b0a22669148fe87680b34fcca2fba

SHA256
c8e1b3ecce673035a934d65b25c43ec23416f5bbf52d772e24e48e6fd3e77e9b

SHA512
61260999bb57817dea2d404bcf093820679e597298c752d38db181fe9963b5fa47e070d6a3c7c970905035b396389bb02946b44869dc8b9560acc419b065999a

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Rinzzkcfiw.lnk

Filesize
1KB

MD5
8c50aa6e85b7800705c690d9e53c316a

SHA1
d3d759c26d9e5630492751e9e5358e85dc1712a3

SHA256
0888ccb6df54ad28ebf95c5206934afaf0c7f4efdc3be1276928a645eebf37e1

SHA512
5bf4ccd8f5f614832b3a733b0a20f69e976c4b921487cc7d82365cf926bbe12c42390e465dc809ab8dcc031525794e35a6ef061e63f5c7a89624092eacb533c3

Download Submit
\Users\Admin\AppData\Local\YV8kdzAr\MFPlat.DLL

Filesize
1.2MB

MD5
9b90f901f6461a109f3d722b4e07ffaa

SHA1
2269e704a49e9408704f3972aac4eb460b9e157f

SHA256
8a72ed3e83564b94d9308933ba9697851894b618b86e6056f6183281e69a1819

SHA512
15c34cee94c7bcd9a3dc0922bc4e7b6f9d179f7eca1c1680ad7fd7b8d74bc905976cc4719b24deab837da92bcdf0e70368878ac761f12834dc52af3873f2538f

Download Submit
\Users\Admin\AppData\Local\YV8kdzAr\mfpmp.exe

Filesize
24KB

MD5
2d8600b94de72a9d771cbb56b9f9c331

SHA1
a0e2ac409159546183aa45875497844c4adb5aac

SHA256
7d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185

SHA512
3aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc

Download Submit
memory/1196-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-24-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-4-0x0000000076E86000-0x0000000076E87000-memory.dmp

Filesize
4KB

Download
memory/1196-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-13-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-29-0x0000000077120000-0x0000000077122000-memory.dmp

Filesize
8KB

Download
memory/1196-5-0x0000000002910000-0x0000000002911000-memory.dmp

Filesize
4KB

Download
memory/1196-37-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-38-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-46-0x0000000076E86000-0x0000000076E87000-memory.dmp

Filesize
4KB

Download
memory/1196-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-25-0x0000000002920000-0x0000000002927000-memory.dmp

Filesize
28KB

Download
memory/1196-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1196-26-0x0000000076F91000-0x0000000076F92000-memory.dmp

Filesize
4KB

Download
memory/1296-72-0x000007FEF73A0000-0x000007FEF74D2000-memory.dmp

Filesize
1.2MB

Download
memory/1296-75-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/1296-78-0x000007FEF73A0000-0x000007FEF74D2000-memory.dmp

Filesize
1.2MB

Download
memory/2028-91-0x000007FEF73A0000-0x000007FEF74D3000-memory.dmp

Filesize
1.2MB

Download
memory/2028-90-0x0000000000270000-0x0000000000277000-memory.dmp

Filesize
28KB

Download
memory/2028-96-0x000007FEF73A0000-0x000007FEF74D3000-memory.dmp

Filesize
1.2MB

Download
memory/2256-31-0x000007FEF7390000-0x000007FEF74C1000-memory.dmp

Filesize
1.2MB

Download
memory/2256-0-0x000007FEF7390000-0x000007FEF74C1000-memory.dmp

Filesize
1.2MB

Download
memory/2256-3-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2656-60-0x000007FEF74D0000-0x000007FEF7608000-memory.dmp

Filesize
1.2MB

Download
memory/2656-54-0x000007FEF74D0000-0x000007FEF7608000-memory.dmp

Filesize
1.2MB

Download
memory/2656-57-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download