dridex | 8dfde40a120fd5954b84e6b064cbe332f43b877ab1787cce2f9e4552cb077e3b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 10:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

de3a0b9b0192ab009b5fb6780863a6de_JaffaCakes118.dll
Size

1.2MB
MD5

de3a0b9b0192ab009b5fb6780863a6de
SHA1

47201ab5c416f3dc1850be9d9af2d5785ac6eaf0
SHA256

8dfde40a120fd5954b84e6b064cbe332f43b877ab1787cce2f9e4552cb077e3b
SHA512

bee84eae73e1426f4f8287e3d012189af4ff5ee8659f2800091866584d643a19435f6aa152b322da148b27bb5bf8cf3ad081f30a75cc9dc46ef525f10abffbec
SSDEEP

24576:yuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9Nb:a9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1200-5-0x0000000002510000-0x0000000002511000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2940	unregmp2.exe
2668	ComputerDefaults.exe
1580	sigverif.exe

Loads dropped DLL 7 IoCs

pid	Process
1200	Process not Found
2940	unregmp2.exe
1200	Process not Found
2668	ComputerDefaults.exe
1200	Process not Found
1580	sigverif.exe
1200	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kccgsbu = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\hu1\\COMPUT~1.EXE"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unregmp2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComputerDefaults.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sigverif.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2400	rundll32.exe
2400	rundll32.exe
2400	rundll32.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2940	1200	Process not Found	31
PID 1200 wrote to memory of 2940	1200	Process not Found	31
PID 1200 wrote to memory of 2940	1200	Process not Found	31
PID 1200 wrote to memory of 3052	1200	Process not Found	32
PID 1200 wrote to memory of 3052	1200	Process not Found	32
PID 1200 wrote to memory of 3052	1200	Process not Found	32
PID 1200 wrote to memory of 2668	1200	Process not Found	33
PID 1200 wrote to memory of 2668	1200	Process not Found	33
PID 1200 wrote to memory of 2668	1200	Process not Found	33
PID 1200 wrote to memory of 1268	1200	Process not Found	34
PID 1200 wrote to memory of 1268	1200	Process not Found	34
PID 1200 wrote to memory of 1268	1200	Process not Found	34
PID 1200 wrote to memory of 1580	1200	Process not Found	35
PID 1200 wrote to memory of 1580	1200	Process not Found	35
PID 1200 wrote to memory of 1580	1200	Process not Found	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de3a0b9b0192ab009b5fb6780863a6de_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2400

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:2568

C:\Users\Admin\AppData\Local\24wa\unregmp2.exe
C:\Users\Admin\AppData\Local\24wa\unregmp2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2940

C:\Windows\system32\ComputerDefaults.exe
C:\Windows\system32\ComputerDefaults.exe
1⤵
PID:3052

C:\Users\Admin\AppData\Local\vDalyKY\ComputerDefaults.exe
C:\Users\Admin\AppData\Local\vDalyKY\ComputerDefaults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2668

C:\Windows\system32\sigverif.exe
C:\Windows\system32\sigverif.exe
1⤵
PID:1268

C:\Users\Admin\AppData\Local\xTFs\sigverif.exe
C:\Users\Admin\AppData\Local\xTFs\sigverif.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\24wa\slc.dll

Filesize
1.2MB

MD5
f840e714cf0c37f3aa151a0aab596341

SHA1
e38c9d37138db6ad937cd44f74462bf8bb857c3f

SHA256
2e690f080d007c38d5defba9a45b7c057842aae7a41ba1cf178850b27d856d0c

SHA512
742994db440f456cc20f4a5689f320677cb4c4778501583ab16fb24087711a93140d15d295f850666371c65ae1aba01d431d11cb7c0e19ef33708b0e8fd58c90

Download Submit
C:\Users\Admin\AppData\Local\vDalyKY\appwiz.cpl

Filesize
1.2MB

MD5
dedd62d736b203aba70a32ca7b0b1ac2

SHA1
312309b439e08a2067c7a47b18d2ade02f7e7e90

SHA256
72db284f70972b6a76b5bc8aa53cf1b5cf16f66975ecbea1062ae95647fcd708

SHA512
28fce680f856608eaf400eea899b52525ffb6dbe55f3023131af96429c1fba09fe1117962d0b9e111e655e08faa943e396c63444caab759ea8302c0436ddbb03

Download Submit
C:\Users\Admin\AppData\Local\xTFs\VERSION.dll

Filesize
1.2MB

MD5
fe3ac0ca6a04f591359a406700a80b65

SHA1
8aec74ed6e50a28a094bd8537956420b30923b51

SHA256
c7c01e7ea56e78c74d318fd391816bf22ddf4fbe2351a454e22a6945943e69ef

SHA512
925c157965ffcbad3c358db7d5f11ff60f7a27d24582cb315c5e95c00c2b8787ce97de0afe2977d8cc433757b1de9887e9a1dcd67911bffa738a37a6fe8fab17

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Lcuygmmobxhxaxh.lnk

Filesize
1KB

MD5
6f8f54158550cf5996a87b175e95d3ce

SHA1
8cce003665b0b479b2d10f569f2299452f06bb68

SHA256
6fd665ef1ad502c2a6899c59ff982586fc33b65248caab914a060b5e282abd8c

SHA512
63518665a3aee128ca94a6386d6472273a032034d1501748d32926467361242a1c2655b7f2c433c5f9b77cf2d4bca337fad4a74dad56a5d1de9b8ca06470a06d

Download Submit
\Users\Admin\AppData\Local\24wa\unregmp2.exe

Filesize
316KB

MD5
64b328d52dfc8cda123093e3f6e4c37c

SHA1
f68f45b21b911906f3aa982e64504e662a92e5ab

SHA256
7d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1

SHA512
e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00

Download Submit
\Users\Admin\AppData\Local\vDalyKY\ComputerDefaults.exe

Filesize
36KB

MD5
86bd981f55341273753ac42ea200a81e

SHA1
14fe410efc9aeb0a905b984ac27719ff0dd10ea7

SHA256
40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

SHA512
49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

Download Submit
\Users\Admin\AppData\Local\xTFs\sigverif.exe

Filesize
73KB

MD5
e8e95ae5534553fc055051cee99a7f55

SHA1
4e0f668849fd546edd083d5981ed685d02a68df4

SHA256
9e107fd99892d08b15c223ac17c49af75a4cbca41b5e939bb91c9dca9f0d0bec

SHA512
5d3c32d136a264b6d2cfba4602e4d8f75e55ba0e199e0e81d7a515c34d8b9237db29647c10ab79081173010ff8e2c6a59b652c0a9cfa796433aed2d200f02da6

Download Submit
memory/1200-37-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-47-0x0000000076C86000-0x0000000076C87000-memory.dmp

Filesize
4KB

Download
memory/1200-16-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-26-0x00000000024F0000-0x00000000024F7000-memory.dmp

Filesize
28KB

Download
memory/1200-25-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-30-0x0000000076F20000-0x0000000076F22000-memory.dmp

Filesize
8KB

Download
memory/1200-27-0x0000000076D91000-0x0000000076D92000-memory.dmp

Filesize
4KB

Download
memory/1200-14-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-13-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-12-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-10-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-4-0x0000000076C86000-0x0000000076C87000-memory.dmp

Filesize
4KB

Download
memory/1200-9-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-38-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-5-0x0000000002510000-0x0000000002511000-memory.dmp

Filesize
4KB

Download
memory/1200-15-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-11-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-17-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-8-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1200-7-0x0000000140000000-0x0000000140132000-memory.dmp

Filesize
1.2MB

Download
memory/1580-96-0x000007FEF5D60000-0x000007FEF5E93000-memory.dmp

Filesize
1.2MB

Download
memory/2400-46-0x000007FEF5D60000-0x000007FEF5E92000-memory.dmp

Filesize
1.2MB

Download
memory/2400-0-0x000007FEF5D60000-0x000007FEF5E92000-memory.dmp

Filesize
1.2MB

Download
memory/2400-3-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2668-73-0x000007FEF5D60000-0x000007FEF5E93000-memory.dmp

Filesize
1.2MB

Download
memory/2668-76-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2668-79-0x000007FEF5D60000-0x000007FEF5E93000-memory.dmp

Filesize
1.2MB

Download
memory/2940-61-0x000007FEF64A0000-0x000007FEF65D3000-memory.dmp

Filesize
1.2MB

Download
memory/2940-56-0x000007FEF64A0000-0x000007FEF65D3000-memory.dmp

Filesize
1.2MB

Download
memory/2940-55-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download