dridex | 15fc496e1a8c2e1c17ef2dbf6fa1652413dc871ea598f12b6d1ea8cc4489665a

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
26-08-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c3c93bcc9d7cf09e654aed755118dc42_JaffaCakes118.dll
Size

1.2MB
MD5

c3c93bcc9d7cf09e654aed755118dc42
SHA1

c0fa398ff4e417f227437ac86c2c413ce2780553
SHA256

15fc496e1a8c2e1c17ef2dbf6fa1652413dc871ea598f12b6d1ea8cc4489665a
SHA512

78cd2acaa474107add69b9dda4b927bc5c1ff78fd1e72328b97a02575516ddc93254a093c9580b37b020572a7cceeeebdf8c9f6bf51e778b17c3a3414f92c8a2
SSDEEP

24576:YVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:YV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1164-5-0x0000000002510000-0x0000000002511000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2728	mfpmp.exe
2296	calc.exe
2040	taskmgr.exe

Loads dropped DLL 7 IoCs

pid	Process
1164	Process not Found
2728	mfpmp.exe
1164	Process not Found
2296	calc.exe
1164	Process not Found
2040	taskmgr.exe
1164	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lnxdhmhg = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\xhgrTny\\calc.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	calc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1984	rundll32.exe
1984	rundll32.exe
1984	rundll32.exe
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found
1164	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 2956	1164	Process not Found	30
PID 1164 wrote to memory of 2956	1164	Process not Found	30
PID 1164 wrote to memory of 2956	1164	Process not Found	30
PID 1164 wrote to memory of 2728	1164	Process not Found	31
PID 1164 wrote to memory of 2728	1164	Process not Found	31
PID 1164 wrote to memory of 2728	1164	Process not Found	31
PID 1164 wrote to memory of 2652	1164	Process not Found	33
PID 1164 wrote to memory of 2652	1164	Process not Found	33
PID 1164 wrote to memory of 2652	1164	Process not Found	33
PID 1164 wrote to memory of 2296	1164	Process not Found	34
PID 1164 wrote to memory of 2296	1164	Process not Found	34
PID 1164 wrote to memory of 2296	1164	Process not Found	34
PID 1164 wrote to memory of 2844	1164	Process not Found	35
PID 1164 wrote to memory of 2844	1164	Process not Found	35
PID 1164 wrote to memory of 2844	1164	Process not Found	35
PID 1164 wrote to memory of 2040	1164	Process not Found	36
PID 1164 wrote to memory of 2040	1164	Process not Found	36
PID 1164 wrote to memory of 2040	1164	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c3c93bcc9d7cf09e654aed755118dc42_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1984

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:2956

C:\Users\Admin\AppData\Local\vqq5\mfpmp.exe
C:\Users\Admin\AppData\Local\vqq5\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2728

C:\Windows\system32\calc.exe
C:\Windows\system32\calc.exe
1⤵
PID:2652

C:\Users\Admin\AppData\Local\fMPM\calc.exe
C:\Users\Admin\AppData\Local\fMPM\calc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2296

C:\Windows\system32\taskmgr.exe
C:\Windows\system32\taskmgr.exe
1⤵
PID:2844

C:\Users\Admin\AppData\Local\WgmP29\taskmgr.exe
C:\Users\Admin\AppData\Local\WgmP29\taskmgr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WgmP29\Secur32.dll

Filesize
1.2MB

MD5
83203eceee3ece6dad9fc6ea3835e3f9

SHA1
80a050ac15213cd09db8b9a49fee6d37c68b83dd

SHA256
f82b55acd5bf9414b4c8f14910d60d8acf7e76d5465c7695b99134905108b056

SHA512
50dc5292d3a3efa7f6c306d07caad9f2d8148ff3262785e5479cba32d12c54383a900073bfe5b820c8403202e8c37d8fbf0c3809fb33b61764aea17b84178b53

Download Submit
C:\Users\Admin\AppData\Local\vqq5\mfpmp.exe

Filesize
24KB

MD5
2d8600b94de72a9d771cbb56b9f9c331

SHA1
a0e2ac409159546183aa45875497844c4adb5aac

SHA256
7d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185

SHA512
3aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Filabyuswgwl.lnk

Filesize
1KB

MD5
ede1c45ece89c406fb5ce6ee9ad255dd

SHA1
43006a8e68e4cc89d0b7ea784169ecb1dd7cbe56

SHA256
5f72237944e5bd663e570e62d7d398176b32eaf211528ff1c790499d95268950

SHA512
87a05a2cc49e87c439d4c9b6dc7393de3992fb64a38fd9316c729b0a9eaafb420cccc6bbba43eb22693e87b5ab7a4958534ad2e8c7433441b598b7892ae73a2c

Download Submit
\Users\Admin\AppData\Local\WgmP29\taskmgr.exe

Filesize
251KB

MD5
09f7401d56f2393c6ca534ff0241a590

SHA1
e8b4d84a28e5ea17272416ec45726964fdf25883

SHA256
6766717b8afafe46b5fd66c7082ccce6b382cbea982c73cb651e35dc8187ace1

SHA512
7187a27cd32c1b295c74e36e1b6148a31d602962448b18395a44a721d17daa7271d0cd198edb2ed05ace439746517ffb1bcc11c7f682e09b025c950ea7b83192

Download Submit
\Users\Admin\AppData\Local\fMPM\WINMM.dll

Filesize
1.2MB

MD5
d18caef102164fffc4a15cfdcd176f39

SHA1
7d3653945945eacbc78a958aad4bb73c2e50cd3c

SHA256
2aee4453cc8f78619becd46af9d5673d518bfbb33183c37923c4bcda9b6ee5b2

SHA512
9b2eaa2f4cdc978d825258d43ae8967139dd92e7ef2e467cb16d1cdcfd3a8ba222451004074d418487d95b8687f984ae3a99bb6245a25d202e981ac514bb54f4

Download Submit
\Users\Admin\AppData\Local\fMPM\calc.exe

Filesize
897KB

MD5
10e4a1d2132ccb5c6759f038cdb6f3c9

SHA1
42d36eeb2140441b48287b7cd30b38105986d68f

SHA256
c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

SHA512
9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

Download Submit
\Users\Admin\AppData\Local\vqq5\MFPlat.DLL

Filesize
1.2MB

MD5
454c61a3f60bf09b9d79061ed478c469

SHA1
c4d255536ee130b609a96672b9623f3632147d90

SHA256
a950951526537fac11bd492f85fc58662cd6b93790c45220d6cd6560c73569ce

SHA512
48864b9ca59ff3d9b27745bf3310e5f0717f1660e5bf6866678e2eb745b4cca2db56bcf7fd035e2b6f1f2c1d2017649aa9697d4c28e58c6dd8645382dc67bf06

Download Submit
memory/1164-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-26-0x00000000024F0000-0x00000000024F7000-memory.dmp

Filesize
28KB

Download
memory/1164-4-0x0000000077416000-0x0000000077417000-memory.dmp

Filesize
4KB

Download
memory/1164-28-0x00000000777B0000-0x00000000777B2000-memory.dmp

Filesize
8KB

Download
memory/1164-27-0x0000000077621000-0x0000000077622000-memory.dmp

Filesize
4KB

Download
memory/1164-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-25-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-37-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-38-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-5-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1164-47-0x0000000077416000-0x0000000077417000-memory.dmp

Filesize
4KB

Download
memory/1164-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-16-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1164-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1984-46-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1984-1-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1984-0-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2040-91-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2040-96-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2296-73-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2296-79-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2728-61-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2728-56-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2728-55-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download