dridex | 60b290310f67adb0ae186b4b938ca466a6b55653b2519261fa425127f5500a1f

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03-09-2024 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Stealers/Dridex.dll
Size

1.2MB
MD5

304109f9a5c3726818b4c3668fdb71fd
SHA1

2eb804e205d15d314e7f67d503940f69f5dc2ef8
SHA256

af26296c75ff26f7ee865df424522d75366ae3e2e80d7d9e89ef8c9398b0836d
SHA512

cf01fca33392dc40495f4c39eb1fd240b425018c7088ca9782d883bb135b5dd469a11941d0d680a69e881fa95c4147d70fe567aeba7e98ff6adfd5c0ca1a0e01
SSDEEP

24576:ZVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:ZV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral21/memory/1196-5-0x0000000002D70000-0x0000000002D71000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2896	wscript.exe
2040	dccw.exe
916	mspaint.exe

Loads dropped DLL 8 IoCs

pid	Process
1196	Process not Found
1196	Process not Found
2896	wscript.exe
1196	Process not Found
2040	dccw.exe
1196	Process not Found
916	mspaint.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wqbazsgxtjodx = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\ACCESS~1\\ACCESS~1\\YUJZJ9~1\\dccw.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wscript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dccw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mspaint.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2668	rundll32.exe
2668	rundll32.exe
2668	rundll32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2168	1196	Process not Found	30
PID 1196 wrote to memory of 2168	1196	Process not Found	30
PID 1196 wrote to memory of 2168	1196	Process not Found	30
PID 1196 wrote to memory of 2896	1196	Process not Found	31
PID 1196 wrote to memory of 2896	1196	Process not Found	31
PID 1196 wrote to memory of 2896	1196	Process not Found	31
PID 1196 wrote to memory of 788	1196	Process not Found	32
PID 1196 wrote to memory of 788	1196	Process not Found	32
PID 1196 wrote to memory of 788	1196	Process not Found	32
PID 1196 wrote to memory of 2040	1196	Process not Found	33
PID 1196 wrote to memory of 2040	1196	Process not Found	33
PID 1196 wrote to memory of 2040	1196	Process not Found	33
PID 1196 wrote to memory of 1036	1196	Process not Found	34
PID 1196 wrote to memory of 1036	1196	Process not Found	34
PID 1196 wrote to memory of 1036	1196	Process not Found	34
PID 1196 wrote to memory of 916	1196	Process not Found	35
PID 1196 wrote to memory of 916	1196	Process not Found	35
PID 1196 wrote to memory of 916	1196	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Stealers\Dridex.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2668

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:2168

C:\Users\Admin\AppData\Local\wGjt9s\wscript.exe
C:\Users\Admin\AppData\Local\wGjt9s\wscript.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2896

C:\Windows\system32\dccw.exe
C:\Windows\system32\dccw.exe
1⤵
PID:788

C:\Users\Admin\AppData\Local\F6r\dccw.exe
C:\Users\Admin\AppData\Local\F6r\dccw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2040

C:\Windows\system32\mspaint.exe
C:\Windows\system32\mspaint.exe
1⤵
PID:1036

C:\Users\Admin\AppData\Local\yNj81d\mspaint.exe
C:\Users\Admin\AppData\Local\yNj81d\mspaint.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\F6r\dxva2.dll

Filesize
1.2MB

MD5
5a06d0bf89a83a599b80b85899d85cea

SHA1
a62ef1718dc9af328abbc95934b9fe9f2d255120

SHA256
134cbb6f7c672b946f583d58b218a2a5d8745ee91d2227c103fc12dcef72389d

SHA512
3a91af3c9fdc1ae516a2f9cdd11c4b517a652c0f584aa83d4991d69cb468f155a5e0aebff181a2f4d65bd8fe9a9b1dde58bb3a96fb35ea546de79a713b6ebee3

Download Submit
C:\Users\Admin\AppData\Local\wGjt9s\VERSION.dll

Filesize
1.2MB

MD5
9fd35f87f7c5b6fad19b0305f7728a13

SHA1
82a01485d4043721024b9a0a9f02ef83d64f8b21

SHA256
31638af6ed38b5b6deb8e78e1e30afc28b219851463d0de5e191bcba68e25a2f

SHA512
598762c7de4a10b260bc835c52e52fe06ea0d3b7f0d65713294ec9913b53b95d623dfdda3db28a3c809e49d71503ac98eb6cfe729fb3cbd1dcc963ba164d60ba

Download Submit
C:\Users\Admin\AppData\Local\yNj81d\MFC42u.dll

Filesize
1.3MB

MD5
e0a4fb747a89090354160e3ea31e7031

SHA1
2d74f3c520a98aa9a2cce79b4d70203e024804ad

SHA256
60ba6864371c1b8fa7b1a97dabe8423426c505cf19a6291fe537e81dba631991

SHA512
b18f21cfd1f887a366eedcbbc14d8e479c45537ebb67918e6391e6c39d5b3e8634b14ca103eccfb0301128e3c44fdde4b1e763e75936869c440ed4c60399ab7c

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Frhyegfvspmw.lnk

Filesize
1KB

MD5
31a8c16939f9b358b54202a85a4eea55

SHA1
21817083b0a456049c60587dbe6ded416d322d03

SHA256
d7be5084d6a54c4e69acba17431352f5b51205448622a96974b3e0321e898fda

SHA512
67227866218788c74a2c60977e6665db38e395272f657abd9df62f2474def28d4175410233487ba71d13f84a957c1b59979880745988454c9fdf5c0ad18463e5

Download Submit
\Users\Admin\AppData\Local\F6r\dccw.exe

Filesize
861KB

MD5
a46cee731351eb4146db8e8a63a5c520

SHA1
8ea441e4a77642e12987ac842b36034230edd731

SHA256
283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5

SHA512
3573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc

Download Submit
\Users\Admin\AppData\Local\wGjt9s\wscript.exe

Filesize
165KB

MD5
8886e0697b0a93c521f99099ef643450

SHA1
851bd390bf559e702b8323062dbeb251d9f2f6f7

SHA256
d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f

SHA512
fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837

Download Submit
\Users\Admin\AppData\Local\yNj81d\mspaint.exe

Filesize
6.4MB

MD5
458f4590f80563eb2a0a72709bfc2bd9

SHA1
3f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6

SHA256
ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f

SHA512
e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681

Download Submit
memory/916-98-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/916-93-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1196-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-37-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-26-0x0000000002D50000-0x0000000002D57000-memory.dmp

Filesize
28KB

Download
memory/1196-27-0x0000000077441000-0x0000000077442000-memory.dmp

Filesize
4KB

Download
memory/1196-25-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-4-0x0000000077336000-0x0000000077337000-memory.dmp

Filesize
4KB

Download
memory/1196-28-0x00000000775D0000-0x00000000775D2000-memory.dmp

Filesize
8KB

Download
memory/1196-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-39-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-5-0x0000000002D70000-0x0000000002D71000-memory.dmp

Filesize
4KB

Download
memory/1196-16-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1196-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2040-75-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2040-81-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2668-46-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2668-0-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2668-3-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/2896-63-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2896-58-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/2896-57-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download