dridex | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-09-2024 19:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stealers/Dridex.dll
Size

1.2MB
MD5

304109f9a5c3726818b4c3668fdb71fd
SHA1

2eb804e205d15d314e7f67d503940f69f5dc2ef8
SHA256

af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
SHA512

cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
SSDEEP

24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral21/memory/1212-5-0x0000000002AF0000-0x0000000002AF1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2732	VaultSysUi.exe
2192	rdrleakdiag.exe
2576	psr.exe

Loads dropped DLL 8 IoCs

pid	Process
1212	Process not Found
1212	Process not Found
2732	VaultSysUi.exe
1212	Process not Found
2192	rdrleakdiag.exe
1212	Process not Found
2576	psr.exe
1212	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Qntpnaypazzlupr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\\Oek7\\rdrleakdiag.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VaultSysUi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdrleakdiag.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	psr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2552	rundll32.exe
2552	rundll32.exe
2552	rundll32.exe
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found
1212	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2868	1212	Process not Found	31
PID 1212 wrote to memory of 2868	1212	Process not Found	31
PID 1212 wrote to memory of 2868	1212	Process not Found	31
PID 1212 wrote to memory of 2732	1212	Process not Found	32
PID 1212 wrote to memory of 2732	1212	Process not Found	32
PID 1212 wrote to memory of 2732	1212	Process not Found	32
PID 1212 wrote to memory of 2736	1212	Process not Found	33
PID 1212 wrote to memory of 2736	1212	Process not Found	33
PID 1212 wrote to memory of 2736	1212	Process not Found	33
PID 1212 wrote to memory of 2192	1212	Process not Found	34
PID 1212 wrote to memory of 2192	1212	Process not Found	34
PID 1212 wrote to memory of 2192	1212	Process not Found	34
PID 1212 wrote to memory of 880	1212	Process not Found	35
PID 1212 wrote to memory of 880	1212	Process not Found	35
PID 1212 wrote to memory of 880	1212	Process not Found	35
PID 1212 wrote to memory of 2576	1212	Process not Found	36
PID 1212 wrote to memory of 2576	1212	Process not Found	36
PID 1212 wrote to memory of 2576	1212	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2552

C:\Windows\system32\VaultSysUi.exe
C:\Windows\system32\VaultSysUi.exe
1⤵
PID:2868

C:\Users\Admin\AppData\Local\JTP\VaultSysUi.exe
C:\Users\Admin\AppData\Local\JTP\VaultSysUi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2732

C:\Windows\system32\rdrleakdiag.exe
C:\Windows\system32\rdrleakdiag.exe
1⤵
PID:2736

C:\Users\Admin\AppData\Local\TI9v\rdrleakdiag.exe
C:\Users\Admin\AppData\Local\TI9v\rdrleakdiag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192

C:\Windows\system32\psr.exe
C:\Windows\system32\psr.exe
1⤵
PID:880

C:\Users\Admin\AppData\Local\Xf2zhz8\psr.exe
C:\Users\Admin\AppData\Local\Xf2zhz8\psr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\JTP\credui.dll

Filesize
1.2MB

MD5
20b32b31cb02f1b9cf4a58e4b786f800

SHA1
c7c498f5c973375c48e41ec04dbc7570b7225f55

SHA256
175085f2461dd1ef2a311dba67f22e124f55079ff74642278d775c3732eb11d4

SHA512
1f8dce7e77ed629321b8d6dee360db0a3f0ee935937a495bf441394a05609d53b22fb40d1a6e810f227aa05564fbe6e3f11d6b6d322f1ba17129ced4f8ad8ed5

Download Submit
C:\Users\Admin\AppData\Local\TI9v\VERSION.dll

Filesize
1.2MB

MD5
6fe3075da14be7b429a6dde425e52df9

SHA1
4e77e59c299d94dce8f024d6bce75b326845d269

SHA256
5851721851c356042456e5cca6e296801b8ef652a810bf7918eabf7663d2ff43

SHA512
81d32c237d5c5d1f3785b185c1ae0055f32f594240fffa66840d1a8514860fc610c21ec0c1ad588949844fdbb708c4a20602092da94827b726cb307b83492f84

Download Submit
C:\Users\Admin\AppData\Local\Xf2zhz8\XmlLite.dll

Filesize
1.2MB

MD5
096d1ebf5bfe47e71a063ae48dd5ebf5

SHA1
5c574b9f7aa92d7a62eb7d47a5f11cf2c6f3fa3e

SHA256
acefe5def8cc3f689ca05e24305509ef7077c0975471d90f55fb7a9498fd8105

SHA512
2692c37ef7af67b177ae1634bcf4efcb6a9c79d4614426bb8fbfa1fae4ddf3564c5f8301b9557aa288d194cf859cd301d644278a55b702d3619a2125856657f8

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Joeqzcwrjre.lnk

Filesize
1KB

MD5
cdcb129eb32c4f89a9b67cc74a685154

SHA1
effa9955aa47b586fc7c197c34c13bb041e98bc3

SHA256
a11a60b07ffb2a81fef08069f56bd8a52f7e87c3a5609fa4a17995bdedc22d77

SHA512
31ba8315d081eb60d7932ffeed9a2c633102d78ed6582bb58320db82c043976eee0c18435019292995442cd45a838248515ca8343c87e5dfcea764a26b37e749

Download Submit
\Users\Admin\AppData\Local\JTP\VaultSysUi.exe

Filesize
39KB

MD5
f40ef105d94350d36c799ee23f7fec0f

SHA1
ee3a5cfe8b807e1c1718a27eb97fa134360816e3

SHA256
eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2

SHA512
f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

Download Submit
\Users\Admin\AppData\Local\TI9v\rdrleakdiag.exe

Filesize
39KB

MD5
5e058566af53848541fa23fba4bb5b81

SHA1
769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6

SHA256
ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409

SHA512
352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0

Download Submit
\Users\Admin\AppData\Local\Xf2zhz8\psr.exe

Filesize
715KB

MD5
a80527109d75cba125d940b007eea151

SHA1
facf32a9ede6abfaa09368bfdfcfec8554107272

SHA256
68910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495

SHA512
77b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774

Download Submit
memory/1212-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-38-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-27-0x0000000077651000-0x0000000077652000-memory.dmp

Filesize
4KB

Download
memory/1212-25-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-4-0x0000000077446000-0x0000000077447000-memory.dmp

Filesize
4KB

Download
memory/1212-28-0x00000000777E0000-0x00000000777E2000-memory.dmp

Filesize
8KB

Download
memory/1212-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-37-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-26-0x0000000002AD0000-0x0000000002AD7000-memory.dmp

Filesize
28KB

Download
memory/1212-47-0x0000000077446000-0x0000000077447000-memory.dmp

Filesize
4KB

Download
memory/1212-16-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1212-5-0x0000000002AF0000-0x0000000002AF1000-memory.dmp

Filesize
4KB

Download
memory/1212-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2192-76-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2192-82-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2552-46-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2552-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2552-1-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2576-97-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2732-64-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2732-59-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2732-58-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download