dridex | 150e6355b4e5d64291ad78878bba7d155a2e5412875e36866ead632f7d9c6d82

Analysis

max time kernel
149s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d60158a83044f3a9cfa793ff367a2974_JaffaCakes118.dll
Size

1.2MB
MD5

d60158a83044f3a9cfa793ff367a2974
SHA1

0da6da782bed9459503edc9a21ee5f6b7ec02c99
SHA256

150e6355b4e5d64291ad78878bba7d155a2e5412875e36866ead632f7d9c6d82
SHA512

11e61830d477990d7f361290af170844dd39d2e406e3e8b37234b3eb75d6ab21d1f2d353e96e8490a4497dc1892a66aaa639915d975e918baf9400b9f4fb6539
SSDEEP

24576:vuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:R9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1196-5-0x0000000002F40000-0x0000000002F41000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2152	mfpmp.exe
2968	mspaint.exe
2912	raserver.exe

Loads dropped DLL 7 IoCs

pid	Process
1196	Process not Found
2152	mfpmp.exe
1196	Process not Found
2968	mspaint.exe
1196	Process not Found
2912	raserver.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mkmfyiwmvqjxba = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\b8\\mspaint.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mspaint.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	raserver.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1792	rundll32.exe
1792	rundll32.exe
1792	rundll32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 3068	1196	Process not Found	30
PID 1196 wrote to memory of 3068	1196	Process not Found	30
PID 1196 wrote to memory of 3068	1196	Process not Found	30
PID 1196 wrote to memory of 2152	1196	Process not Found	31
PID 1196 wrote to memory of 2152	1196	Process not Found	31
PID 1196 wrote to memory of 2152	1196	Process not Found	31
PID 1196 wrote to memory of 1504	1196	Process not Found	32
PID 1196 wrote to memory of 1504	1196	Process not Found	32
PID 1196 wrote to memory of 1504	1196	Process not Found	32
PID 1196 wrote to memory of 2968	1196	Process not Found	33
PID 1196 wrote to memory of 2968	1196	Process not Found	33
PID 1196 wrote to memory of 2968	1196	Process not Found	33
PID 1196 wrote to memory of 2828	1196	Process not Found	34
PID 1196 wrote to memory of 2828	1196	Process not Found	34
PID 1196 wrote to memory of 2828	1196	Process not Found	34
PID 1196 wrote to memory of 2912	1196	Process not Found	35
PID 1196 wrote to memory of 2912	1196	Process not Found	35
PID 1196 wrote to memory of 2912	1196	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\d60158a83044f3a9cfa793ff367a2974_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1792

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:3068

C:\Users\Admin\AppData\Local\2DvzsKRIv\mfpmp.exe
C:\Users\Admin\AppData\Local\2DvzsKRIv\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2152

C:\Windows\system32\mspaint.exe
C:\Windows\system32\mspaint.exe
1⤵
PID:1504

C:\Users\Admin\AppData\Local\4yjO\mspaint.exe
C:\Users\Admin\AppData\Local\4yjO\mspaint.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2968

C:\Windows\system32\raserver.exe
C:\Windows\system32\raserver.exe
1⤵
PID:2828

C:\Users\Admin\AppData\Local\37OS4\raserver.exe
C:\Users\Admin\AppData\Local\37OS4\raserver.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\2DvzsKRIv\MFPlat.DLL

Filesize
1.2MB

MD5
3457b1838224bc55af3f594d04425ee6

SHA1
ee3379bfbdf51967e6a35ecff60aba16b43e7f73

SHA256
446273562f38155b36492d7469837bcb76add2a48a9dcb3d463a56b8020745f9

SHA512
be7ffe89aed3a2380a926aa4b0a1258f1b675b23eccfa60b1a3fdaa2b59f191647ec43a779a583ed0bc34da30b144a08bb5ecf500459dacb055f7c52d27b7ca7

Download Submit
C:\Users\Admin\AppData\Local\37OS4\WTSAPI32.dll

Filesize
1.2MB

MD5
28671244fb5880412c0411cc3cd522c6

SHA1
babacaf1eaa2ccb82bd34401364f92312d0a33b8

SHA256
49e24d8c1af996e83b481a50ef31eaa839529ea045893a3ff64988ee896adb8e

SHA512
6373bfc987e0040c4f5f489949728a32c209b8da6fdfea4ee3d987fa57a94ca92c645642d2cc162675f59524cbc02e7b1426d4ff0ea4a41d066b5f831ef08bf9

Download Submit
C:\Users\Admin\AppData\Local\4yjO\WINMM.dll

Filesize
1.2MB

MD5
25db74389b7a704808a87d81164e3c00

SHA1
6c9d83bca1298be1d72886f394a0b84f773112cc

SHA256
50e24d39b49e688181b9a5e1030e9af35a9d7d3a83b596c2fe78a69bca2194b0

SHA512
473e3145df3de0b9ede44a148e119934e5ba5fdd0fa2b79fe32c8f81db50ac41e615a5f1cc40b39fe141ddb9b159746118bdfc3a67c59257c6b9cce7a78f1fa1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ppapbotpack.lnk

Filesize
1KB

MD5
929b3e7b8e384db43276fcfeb871215d

SHA1
92e6ff0d78eaab024a12b751d9cb9f531309365d

SHA256
bf722581e173443516763c6f375719a088210b96404f6d878188bdf721faf116

SHA512
9e7ce51cea62fd9d3d177e1b9f4558ef8b6fbe9b3178826380c96fed0005a1639dd6252128a9f75561a3d4418af750404ca52bab31d35770f7975c98df72290a

Download Submit
\Users\Admin\AppData\Local\2DvzsKRIv\mfpmp.exe

Filesize
24KB

MD5
2d8600b94de72a9d771cbb56b9f9c331

SHA1
a0e2ac409159546183aa45875497844c4adb5aac

SHA256
7d8d8918761b8b6c95758375a6e7cf7fb8e43abfdd3846476219883ef3f8c185

SHA512
3aaa6619f29434c294b9b197c3b86fdc5d88b0254c8f35f010c9b5f254fd47fbc3272412907e2a5a4f490bda2acfbbd7a90f968e25067abf921b934d2616eafc

Download Submit
\Users\Admin\AppData\Local\37OS4\raserver.exe

Filesize
123KB

MD5
cd0bc0b6b8d219808aea3ecd4e889b19

SHA1
9f8f4071ce2484008e36fdfd963378f4ebad703f

SHA256
16abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c

SHA512
84291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac

Download Submit
\Users\Admin\AppData\Local\4yjO\mspaint.exe

Filesize
6.4MB

MD5
458f4590f80563eb2a0a72709bfc2bd9

SHA1
3f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6

SHA256
ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f

SHA512
e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681

Download Submit
memory/1196-12-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-14-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-4-0x00000000771B6000-0x00000000771B7000-memory.dmp

Filesize
4KB

Download
memory/1196-11-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-10-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-9-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-8-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-7-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-25-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-26-0x00000000773C1000-0x00000000773C2000-memory.dmp

Filesize
4KB

Download
memory/1196-27-0x0000000077550000-0x0000000077552000-memory.dmp

Filesize
8KB

Download
memory/1196-36-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-37-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-5-0x0000000002F40000-0x0000000002F41000-memory.dmp

Filesize
4KB

Download
memory/1196-46-0x00000000771B6000-0x00000000771B7000-memory.dmp

Filesize
4KB

Download
memory/1196-13-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-23-0x0000000002F20000-0x0000000002F27000-memory.dmp

Filesize
28KB

Download
memory/1196-16-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1196-15-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/1792-45-0x000007FEF7680000-0x000007FEF77B0000-memory.dmp

Filesize
1.2MB

Download
memory/1792-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1792-1-0x000007FEF7680000-0x000007FEF77B0000-memory.dmp

Filesize
1.2MB

Download
memory/2152-60-0x000007FEF77A0000-0x000007FEF78D2000-memory.dmp

Filesize
1.2MB

Download
memory/2152-54-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2152-55-0x000007FEF77A0000-0x000007FEF78D2000-memory.dmp

Filesize
1.2MB

Download
memory/2912-90-0x000007FEF7670000-0x000007FEF77A1000-memory.dmp

Filesize
1.2MB

Download
memory/2912-95-0x000007FEF7670000-0x000007FEF77A1000-memory.dmp

Filesize
1.2MB

Download
memory/2968-72-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/2968-73-0x000007FEF64B0000-0x000007FEF65E2000-memory.dmp

Filesize
1.2MB

Download
memory/2968-78-0x000007FEF64B0000-0x000007FEF65E2000-memory.dmp

Filesize
1.2MB

Download