dridex | 912ee7943db3b7e80cca61c022154f0fc13ef29ff948a89bbc87ed1b2938ac94

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
06-09-2024 09:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf42baf701af133c3b5644942b098edd_JaffaCakes118.dll
Size

1.2MB
MD5

cf42baf701af133c3b5644942b098edd
SHA1

fa131bba515e453c67ecb025dfd4f8f2d76a01bc
SHA256

912ee7943db3b7e80cca61c022154f0fc13ef29ff948a89bbc87ed1b2938ac94
SHA512

873c88128d15175aed92577de51d2113723f00fb10358551affa4764e619707a453d25f2d3f3d5a028dfd9784cabb051916424dfde4df87aa2a0ee34beaae750
SSDEEP

24576:9uYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:X9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1200-5-0x0000000002E70000-0x0000000002E71000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

SystemPropertiesRemote.exesethc.exewbengine.exe

pid	Process
2456	SystemPropertiesRemote.exe
2996	sethc.exe
1620	wbengine.exe

Loads dropped DLL 7 IoCs

Processes:

SystemPropertiesRemote.exesethc.exewbengine.exe

pid	Process
1200
2456	SystemPropertiesRemote.exe
1200
2996	sethc.exe
1200
1620	wbengine.exe
1200

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wqbazsgxtjodx = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\kffMxRiPA9\\sethc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

SystemPropertiesRemote.exesethc.exewbengine.exerundll32.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesRemote.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sethc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wbengine.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
2116	rundll32.exe
2116	rundll32.exe
2116	rundll32.exe
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	procid_target
PID 1200 wrote to memory of 2576	1200	31
PID 1200 wrote to memory of 2576	1200	31
PID 1200 wrote to memory of 2576	1200	31
PID 1200 wrote to memory of 2456	1200	32
PID 1200 wrote to memory of 2456	1200	32
PID 1200 wrote to memory of 2456	1200	32
PID 1200 wrote to memory of 1964	1200	33
PID 1200 wrote to memory of 1964	1200	33
PID 1200 wrote to memory of 1964	1200	33
PID 1200 wrote to memory of 2996	1200	34
PID 1200 wrote to memory of 2996	1200	34
PID 1200 wrote to memory of 2996	1200	34
PID 1200 wrote to memory of 1224	1200	35
PID 1200 wrote to memory of 1224	1200	35
PID 1200 wrote to memory of 1224	1200	35
PID 1200 wrote to memory of 1620	1200	36
PID 1200 wrote to memory of 1620	1200	36
PID 1200 wrote to memory of 1620	1200	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cf42baf701af133c3b5644942b098edd_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2116

C:\Windows\system32\SystemPropertiesRemote.exe
C:\Windows\system32\SystemPropertiesRemote.exe
1⤵
PID:2576

C:\Users\Admin\AppData\Local\Y8JG9K\SystemPropertiesRemote.exe
C:\Users\Admin\AppData\Local\Y8JG9K\SystemPropertiesRemote.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2456

C:\Windows\system32\sethc.exe
C:\Windows\system32\sethc.exe
1⤵
PID:1964

C:\Users\Admin\AppData\Local\JnJxxXw\sethc.exe
C:\Users\Admin\AppData\Local\JnJxxXw\sethc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2996

C:\Windows\system32\wbengine.exe
C:\Windows\system32\wbengine.exe
1⤵
PID:1224

C:\Users\Admin\AppData\Local\KVN5UilxT\wbengine.exe
C:\Users\Admin\AppData\Local\KVN5UilxT\wbengine.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\JnJxxXw\DUI70.dll

Filesize
1.4MB

MD5
03b6eaf8e13da1fe144c6e7dd899c9fc

SHA1
51196a58e70b60afd17b33582e90f51d80979145

SHA256
7a287c004dcd762c4583af27bf589e3d831923447099a12300f06283a14f81a3

SHA512
edee126835daca5fc4c0495c668193279c0cf7736e54f428f3d664c804edcccf2269c18526122d723899da990e18706797481fcaf8a3a995d9d3aff299bb146b

Download Submit
C:\Users\Admin\AppData\Local\KVN5UilxT\XmlLite.dll

Filesize
1.2MB

MD5
5f9e0e9b43a2340ee2ffe9aa7bc0f0fe

SHA1
810ee681d73d589b7a0b618314a370c71201b015

SHA256
7014b75e3d6f33d0356b62f96d903be92575c9cefc80b4124b82b15ba89244e1

SHA512
0fa329d3a68ff08f07cd0bb41ce0f15958a450b3d80af1e81f14d5da7603fc44d2454fbc5f860aa51605623954b0459ceb7e5e3420c59534d767b803f3f6d01d

Download Submit
C:\Users\Admin\AppData\Local\Y8JG9K\SYSDM.CPL

Filesize
1.2MB

MD5
7b9e6552f2e19966c41698ae0c01eceb

SHA1
a96789f650357364132d44e72d3861ecd03da4dd

SHA256
b61ae89b58af44b10f2a702ee4118d0b64f7036e2db429041c9b02d55010ab1a

SHA512
d6c6eb8054531afcae1f6abd2ee7501986ae214f1abc48187c5df9e61db50ad109207220ceab446fb48f8d800498bb5b6eae3c1ccede98ea1b8ebd3d941eef45

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Frhyegfvspmw.lnk

Filesize
1KB

MD5
633496c9b26c37d286d145daefd8a713

SHA1
408013ce85a3457e4556f83fafdebca919b115c7

SHA256
25527805bab9eb24a6c3e6892b45f3713bd01094ef9ae02aff3428811da6798b

SHA512
be837f41826258806ecc3c1b6f05d0f228c6ca728b47a49cce825e77e9d46c6ee1c53c347b9c558273ef8b06574d53d364d446c28777d85c391b99bf5a505db5

Download Submit
\Users\Admin\AppData\Local\JnJxxXw\sethc.exe

Filesize
272KB

MD5
3bcb70da9b5a2011e01e35ed29a3f3f3

SHA1
9daecb1ee5d7cbcf46ee154dd642fcd993723a9b

SHA256
dd94bf73f0e3652b76cfb774b419ceaa2082bc7f30cc34e28dfa51952fa9ccb5

SHA512
69d231132f488fd7033349f232db1207f88f1d5cb84f5422adf0dd5fb7b373dada8fdfac7760b8845e5aab00a7ae56f24d66bbb8aa70c3c8de6ec5c31982b4df

Download Submit
\Users\Admin\AppData\Local\KVN5UilxT\wbengine.exe

Filesize
1.4MB

MD5
78f4e7f5c56cb9716238eb57da4b6a75

SHA1
98b0b9db6ec5961dbb274eff433a8bc21f7e557b

SHA256
46a4e78ce5f2a4b26f4e9c3ff04a99d9b727a82ac2e390a82a1611c3f6e0c9af

SHA512
1a24ea71624dbbca188ee3b4812e09bc42e7d38ceac02b69940d7693475c792685a23141c8faa85a87ab6aace3f951c1a81facb610d757ac6df37cf2aa65ccd2

Download Submit
\Users\Admin\AppData\Local\Y8JG9K\SystemPropertiesRemote.exe

Filesize
80KB

MD5
d0d7ac869aa4e179da2cc333f0440d71

SHA1
e7b9a58f5bfc1ec321f015641a60978c0c683894

SHA256
5762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a

SHA512
1808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7

Download Submit
memory/1200-26-0x0000000077CB1000-0x0000000077CB2000-memory.dmp

Filesize
4KB

Download
memory/1200-14-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-4-0x0000000077BA6000-0x0000000077BA7000-memory.dmp

Filesize
4KB

Download
memory/1200-16-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-15-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-13-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-12-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-11-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-10-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-9-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-27-0x0000000077E40000-0x0000000077E42000-memory.dmp

Filesize
8KB

Download
memory/1200-36-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-38-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-5-0x0000000002E70000-0x0000000002E71000-memory.dmp

Filesize
4KB

Download
memory/1200-46-0x0000000077BA6000-0x0000000077BA7000-memory.dmp

Filesize
4KB

Download
memory/1200-24-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-25-0x0000000002E50000-0x0000000002E57000-memory.dmp

Filesize
28KB

Download
memory/1200-7-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1200-8-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1620-89-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1620-90-0x000007FEF7040000-0x000007FEF7171000-memory.dmp

Filesize
1.2MB

Download
memory/1620-95-0x000007FEF7040000-0x000007FEF7171000-memory.dmp

Filesize
1.2MB

Download
memory/2116-45-0x000007FEF7050000-0x000007FEF7180000-memory.dmp

Filesize
1.2MB

Download
memory/2116-0-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2116-1-0x000007FEF7050000-0x000007FEF7180000-memory.dmp

Filesize
1.2MB

Download
memory/2456-60-0x000007FEF7AE0000-0x000007FEF7C11000-memory.dmp

Filesize
1.2MB

Download
memory/2456-55-0x000007FEF7AE0000-0x000007FEF7C11000-memory.dmp

Filesize
1.2MB

Download
memory/2456-54-0x0000000000290000-0x0000000000297000-memory.dmp

Filesize
28KB

Download
memory/2996-72-0x000007FEF7010000-0x000007FEF7174000-memory.dmp

Filesize
1.4MB

Download
memory/2996-77-0x000007FEF7010000-0x000007FEF7174000-memory.dmp

Filesize
1.4MB

Download