dridex | 028d57c42088b9a1346732bb9d7d19c2324293e9e7e1d7b39e602edaa9c878de

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
30-08-2024 20:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cb97f3b10b212687f53bd9a867b48792_JaffaCakes118.dll
Size

989KB
MD5

cb97f3b10b212687f53bd9a867b48792
SHA1

af2894245835fca466a102b9cc5269ba2e4d8cd6
SHA256

028d57c42088b9a1346732bb9d7d19c2324293e9e7e1d7b39e602edaa9c878de
SHA512

977ba2dcd9c2ebd059ebf35c9b010c45dc8d80c1b3105ee1607bd99dc663517a126a8c4a3726bacd84d5545a14c921d689537dee31b7e6db15075ffda9e2ac66
SSDEEP

24576:xVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:xV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1120-5-0x00000000029B0000-0x00000000029B1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2816	unregmp2.exe
2508	xpsrchvw.exe
1584	FXSCOVER.exe

Loads dropped DLL 7 IoCs

pid	Process
1120	Process not Found
2816	unregmp2.exe
1120	Process not Found
2508	xpsrchvw.exe
1120	Process not Found
1584	FXSCOVER.exe
1120	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nvzakw = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\GWI7LD~1\\xpsrchvw.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unregmp2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xpsrchvw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FXSCOVER.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2812	rundll32.exe
2812	rundll32.exe
2812	rundll32.exe
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found
1120	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2484	1120	Process not Found	30
PID 1120 wrote to memory of 2484	1120	Process not Found	30
PID 1120 wrote to memory of 2484	1120	Process not Found	30
PID 1120 wrote to memory of 2816	1120	Process not Found	31
PID 1120 wrote to memory of 2816	1120	Process not Found	31
PID 1120 wrote to memory of 2816	1120	Process not Found	31
PID 1120 wrote to memory of 2472	1120	Process not Found	32
PID 1120 wrote to memory of 2472	1120	Process not Found	32
PID 1120 wrote to memory of 2472	1120	Process not Found	32
PID 1120 wrote to memory of 2508	1120	Process not Found	33
PID 1120 wrote to memory of 2508	1120	Process not Found	33
PID 1120 wrote to memory of 2508	1120	Process not Found	33
PID 1120 wrote to memory of 2028	1120	Process not Found	34
PID 1120 wrote to memory of 2028	1120	Process not Found	34
PID 1120 wrote to memory of 2028	1120	Process not Found	34
PID 1120 wrote to memory of 1584	1120	Process not Found	35
PID 1120 wrote to memory of 1584	1120	Process not Found	35
PID 1120 wrote to memory of 1584	1120	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cb97f3b10b212687f53bd9a867b48792_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2812

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:2484

C:\Users\Admin\AppData\Local\kBJ7pE\unregmp2.exe
C:\Users\Admin\AppData\Local\kBJ7pE\unregmp2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2816

C:\Windows\system32\xpsrchvw.exe
C:\Windows\system32\xpsrchvw.exe
1⤵
PID:2472

C:\Users\Admin\AppData\Local\x3D7rB\xpsrchvw.exe
C:\Users\Admin\AppData\Local\x3D7rB\xpsrchvw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2508

C:\Windows\system32\FXSCOVER.exe
C:\Windows\system32\FXSCOVER.exe
1⤵
PID:2028

C:\Users\Admin\AppData\Local\2dIb\FXSCOVER.exe
C:\Users\Admin\AppData\Local\2dIb\FXSCOVER.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2dIb\FXSCOVER.exe

Filesize
261KB

MD5
5e2c61be8e093dbfe7fc37585be42869

SHA1
ed46cda4ece3ef187b0cf29ca843a6c6735af6c0

SHA256
3d1719c1caa5d6b0358830a30713c43a9710fbf7bcedca20815be54d24aa9121

SHA512
90bf180c8f6e3d0286a19fcd4727f23925a39c90113db979e1b4bbf8f0491471ad26c877a6e2cf49638b14050d952a9ee02a3c1293129843ec6bba01bc325d0b

Download Submit
C:\Users\Admin\AppData\Local\kBJ7pE\slc.dll

Filesize
991KB

MD5
216e2c618be590aa686880ecffe0d5b4

SHA1
35d3f3a052a6270dc998212b2e72940daf79945e

SHA256
5e71b0bd10cc00cf41af988a825b798705c8a8db87c97b8622294dbe23459151

SHA512
b7b781b4e2f53ba724daae5c5c2814717973ab7d4c471af59e61b678fe518afe4c62a56261fd396cd5d30659a0c8ae306e2b6ac900add70ab0c0f71d9044a88c

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Acjenwgziemamyd.lnk

Filesize
1KB

MD5
3532caf31680b56db245f8cf8e61d36c

SHA1
87ab28cedfd9dbccf4cfb45e026fd026564e1feb

SHA256
18580c5bd004ffbf3b3dbd9ac4c51f51b721e4ed9d9af190261fabc36fa660bd

SHA512
c5b3a064058776bd1754856df30150b88bbc49fbd1215a73d9417bea09bdfc7336a1591788471c7800a28d7a6c4c2f425e3cdfd43a945fbceca0c0f89d79bd64

Download Submit
\Users\Admin\AppData\Local\2dIb\MFC42u.dll

Filesize
1017KB

MD5
22852259e58c8047156e15691ac2fec8

SHA1
31784ab30cc061f0c60fb7c53f995959eced3d0c

SHA256
6bd36fd95eb94edf413f8a1731051a0b17c0dceaddc661a76a2e3699c46b9350

SHA512
085d6fd80a0294a8b791867784f63dbe73d8bab44498528eb4be58457a4ee6e2a7ad43e5df1ed40d829654cd826a26fdd5bb500b6c57de583155cc4d1322f2ef

Download Submit
\Users\Admin\AppData\Local\kBJ7pE\unregmp2.exe

Filesize
316KB

MD5
64b328d52dfc8cda123093e3f6e4c37c

SHA1
f68f45b21b911906f3aa982e64504e662a92e5ab

SHA256
7d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1

SHA512
e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00

Download Submit
\Users\Admin\AppData\Local\x3D7rB\WINMM.dll

Filesize
994KB

MD5
93ac413471ecba351173ff5f9d1f75b1

SHA1
e600fbab40a08b5e1d5ee76244e51daf227fd2d2

SHA256
41dc34bc535305794eaab3531bdb1ec99ed2b846d5dab4ca5191a7e238f8023a

SHA512
e12a013d10e9f620850ec0d1e49f2b6ec7bef3b4a8037191bf6b2d00cf60dae5f1f9d73472933b813d0237fd0468e461f3b7f964e490d192b15db610c9d4c55e

Download Submit
\Users\Admin\AppData\Local\x3D7rB\xpsrchvw.exe

Filesize
4.6MB

MD5
492cb6a624d5dad73ee0294b5db37dd6

SHA1
e74806af04a5147ccabfb5b167eb95a0177c43b3

SHA256
ccb4ecd48561ce024ea176b7036f0f2713b98bc82aa37347a30d8187762a8784

SHA512
63bf2931764efe767fb42f9576702dd585a032f74ad2be2481eaf309f34950f05974d77b5cb220a3ff89c92af0c7693dc558f8e3a3ee2a0be6c5c07171d03835

Download Submit
memory/1120-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-26-0x0000000077AB0000-0x0000000077AB2000-memory.dmp

Filesize
8KB

Download
memory/1120-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-4-0x0000000077716000-0x0000000077717000-memory.dmp

Filesize
4KB

Download
memory/1120-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-5-0x00000000029B0000-0x00000000029B1000-memory.dmp

Filesize
4KB

Download
memory/1120-45-0x0000000077716000-0x0000000077717000-memory.dmp

Filesize
4KB

Download
memory/1120-25-0x0000000077921000-0x0000000077922000-memory.dmp

Filesize
4KB

Download
memory/1120-24-0x00000000025B0000-0x00000000025B7000-memory.dmp

Filesize
28KB

Download
memory/1120-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1120-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1584-89-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/1584-93-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/2508-74-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/2508-71-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2508-77-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2812-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2812-0-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2812-3-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2816-59-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2816-53-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2816-54-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download