dridex | 3f3ad389e9541bbce7ff09e031de4105c89ad468be01b7ef7310f189e2b98642

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
16-09-2024 08:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Trojan.Win64.Dridex.ASFS.dll
Size

968KB
MD5

2f6f37b1fbcaef784678f6c7c28b0000
SHA1

a95e2e1be2d3ff1981431b0410d085c26f3cee23
SHA256

3f3ad389e9541bbce7ff09e031de4105c89ad468be01b7ef7310f189e2b98642
SHA512

00a7e7919324f165262a70fcdd581b68ce7ff8a7ced313b6f8ba8511f20caf2c002a8bdc803a21d5263fde986691112649653ecf6a4fe27bdaab9248cf16e197
SSDEEP

12288:LfJV6EzPTIzQF9mVz5wYacR/8HiFeQBsjgyvunuAoA2U3PxyWhD:LhVXu8mZ5racR/xFejmnuAD2U3Prh

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1196-4-0x0000000002E80000-0x0000000002E81000-memory.dmp	dridex_stager_shellcode

Dridex payload 12 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral1/memory/2268-1-0x000007FEF80B0000-0x000007FEF81A2000-memory.dmp	dridex_payload
behavioral1/memory/1196-23-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1196-31-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1196-42-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1196-43-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/2268-51-0x000007FEF80B0000-0x000007FEF81A2000-memory.dmp	dridex_payload
behavioral1/memory/468-61-0x000007FEF81B0000-0x000007FEF82A3000-memory.dmp	dridex_payload
behavioral1/memory/468-65-0x000007FEF81B0000-0x000007FEF82A3000-memory.dmp	dridex_payload
behavioral1/memory/2236-77-0x000007FEF8080000-0x000007FEF8174000-memory.dmp	dridex_payload
behavioral1/memory/2236-82-0x000007FEF8080000-0x000007FEF8174000-memory.dmp	dridex_payload
behavioral1/memory/1996-99-0x000007FEF8080000-0x000007FEF8173000-memory.dmp	dridex_payload
behavioral1/memory/1996-95-0x000007FEF8080000-0x000007FEF8173000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

pid	Process
468	javaws.exe
2236	tcmsetup.exe
1996	wextract.exe

Loads dropped DLL 7 IoCs

pid	Process
1196	Process not Found
468	javaws.exe
1196	Process not Found
2236	tcmsetup.exe
1196	Process not Found
1996	wextract.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\Wtobeyey = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Credentials\\wj7\\tcmsetup.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	javaws.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	tcmsetup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wextract.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2268	rundll32.exe
2268	rundll32.exe
2268	rundll32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
468	javaws.exe
468	javaws.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1988	1196	Process not Found	31
PID 1196 wrote to memory of 1988	1196	Process not Found	31
PID 1196 wrote to memory of 1988	1196	Process not Found	31
PID 1196 wrote to memory of 468	1196	Process not Found	32
PID 1196 wrote to memory of 468	1196	Process not Found	32
PID 1196 wrote to memory of 468	1196	Process not Found	32
PID 1196 wrote to memory of 2192	1196	Process not Found	33
PID 1196 wrote to memory of 2192	1196	Process not Found	33
PID 1196 wrote to memory of 2192	1196	Process not Found	33
PID 1196 wrote to memory of 2236	1196	Process not Found	34
PID 1196 wrote to memory of 2236	1196	Process not Found	34
PID 1196 wrote to memory of 2236	1196	Process not Found	34
PID 1196 wrote to memory of 1336	1196	Process not Found	35
PID 1196 wrote to memory of 1336	1196	Process not Found	35
PID 1196 wrote to memory of 1336	1196	Process not Found	35
PID 1196 wrote to memory of 1996	1196	Process not Found	36
PID 1196 wrote to memory of 1996	1196	Process not Found	36
PID 1196 wrote to memory of 1996	1196	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\Trojan.Win64.Dridex.ASFS.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Windows\system32\javaws.exe
C:\Windows\system32\javaws.exe
1⤵
PID:1988

C:\Users\Admin\AppData\Local\GRd\javaws.exe
C:\Users\Admin\AppData\Local\GRd\javaws.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:468

C:\Windows\system32\tcmsetup.exe
C:\Windows\system32\tcmsetup.exe
1⤵
PID:2192

C:\Users\Admin\AppData\Local\Q8SvcqzxY\tcmsetup.exe
C:\Users\Admin\AppData\Local\Q8SvcqzxY\tcmsetup.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2236

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:1336

C:\Users\Admin\AppData\Local\DP93vXHvE\wextract.exe
C:\Users\Admin\AppData\Local\DP93vXHvE\wextract.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DP93vXHvE\VERSION.dll

Filesize
972KB

MD5
acdaf0f53241405a9342c09e3cbb3ef2

SHA1
73e1bc7fc891b16dd086ce76acc54367cf1ce5ae

SHA256
5a56356bd74ad76167c90c0209c4b41ea0eb75072e58651ebcfd36c689cbb6bb

SHA512
4651d649729907cde51fbd35c0b5435300bf197aa61a7b79952f0fc2fb8ce374171950bd59048a2de97d5ff6b6edd3ad08d49759d4dbf39c5e66a8c077b0a423

Download Submit
C:\Users\Admin\AppData\Local\Q8SvcqzxY\TAPI32.dll

Filesize
976KB

MD5
ffffc6c3d74a132abd55226e3798c27d

SHA1
ff22f20428bd8143d6af6e253bc7820562932891

SHA256
93c7067fc3dc4c833dea20102947485f32383141ee1eab7b5f38e57b8c2d9492

SHA512
0e8568616b10c666e48baa6f15e7059bee418de8f5fc0068b0101f382933e99a28d93bb959828d4f6cfc04777c7b5e778489ad2d54569d87a936a9fcf6b5bff7

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ykefwsdudlbqds.lnk

Filesize
1KB

MD5
cca0ccd292a7f55b08f7304addc4f602

SHA1
cbc216b8a0f7a27e92a850cb9530332bed9254ab

SHA256
97491e43fbf75c248a5c7d0577d0e2804b70c5957516b72851074b177516b3f9

SHA512
0037468e7d60d49d094e660a757e601255e9a5314eaa5b12a93b5f88cf33f63403853fffa93fb232c61a49a9a54ee94215bc055a0aa7f9429f93ccf1faef37cc

Download Submit
\Users\Admin\AppData\Local\DP93vXHvE\wextract.exe

Filesize
140KB

MD5
1ea6500c25a80e8bdb65099c509af993

SHA1
6a090ef561feb4ae1c6794de5b19c5e893c4aafc

SHA256
99123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2

SHA512
b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb

Download Submit
\Users\Admin\AppData\Local\GRd\VERSION.dll

Filesize
972KB

MD5
3f2c115e995f12477a387b15a6a24beb

SHA1
9e99a5db552093fc092cdf253e2bc62c499c8e5c

SHA256
24e86389c5d26bec802e82ff8e1f49e01c7a367d4b35e51ce52a2fe032f56906

SHA512
389cfcb0a0bd0b4456c61fa7ab418b60dce5260aa031166d13476326aea293ee8822eed47615df43004fcbe7231c4320eee74005ea6b65b6dfa5a46f53fec466

Download Submit
\Users\Admin\AppData\Local\GRd\javaws.exe

Filesize
312KB

MD5
f94bc1a70c942621c4279236df284e04

SHA1
8f46d89c7db415a7f48ccd638963028f63df4e4f

SHA256
be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c

SHA512
60edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52

Download Submit
\Users\Admin\AppData\Local\Q8SvcqzxY\tcmsetup.exe

Filesize
15KB

MD5
0b08315da0da7f9f472fbab510bfe7b8

SHA1
33ba48fd980216becc532466a5ff8476bec0b31c

SHA256
e19556bb7aa39bbd5f0d568a95aec0b3af18dda438cc5737f945243b24d106e7

SHA512
c30501546efe2b0c003ef87ac381e901c69ddfc6791c6a5102cff3a07f56555d94995a4413b93036821aa214fc31501fa87eb519e1890ef75b2ec497983ffd58

Download Submit
memory/468-65-0x000007FEF81B0000-0x000007FEF82A3000-memory.dmp

Filesize
972KB

Download
memory/468-60-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download
memory/468-61-0x000007FEF81B0000-0x000007FEF82A3000-memory.dmp

Filesize
972KB

Download
memory/1196-18-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-43-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-17-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-16-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-15-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-14-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-13-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-12-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-11-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-10-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-9-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-8-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-22-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-31-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-33-0x0000000077770000-0x0000000077772000-memory.dmp

Filesize
8KB

Download
memory/1196-32-0x0000000077740000-0x0000000077742000-memory.dmp

Filesize
8KB

Download
memory/1196-42-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-3-0x00000000774D6000-0x00000000774D7000-memory.dmp

Filesize
4KB

Download
memory/1196-4-0x0000000002E80000-0x0000000002E81000-memory.dmp

Filesize
4KB

Download
memory/1196-52-0x00000000774D6000-0x00000000774D7000-memory.dmp

Filesize
4KB

Download
memory/1196-19-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-20-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-21-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-23-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-30-0x0000000002610000-0x0000000002617000-memory.dmp

Filesize
28KB

Download
memory/1196-7-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1196-6-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1996-99-0x000007FEF8080000-0x000007FEF8173000-memory.dmp

Filesize
972KB

Download
memory/1996-95-0x000007FEF8080000-0x000007FEF8173000-memory.dmp

Filesize
972KB

Download
memory/1996-94-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/2236-79-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2236-77-0x000007FEF8080000-0x000007FEF8174000-memory.dmp

Filesize
976KB

Download
memory/2236-82-0x000007FEF8080000-0x000007FEF8174000-memory.dmp

Filesize
976KB

Download
memory/2268-51-0x000007FEF80B0000-0x000007FEF81A2000-memory.dmp

Filesize
968KB

Download
memory/2268-1-0x000007FEF80B0000-0x000007FEF81A2000-memory.dmp

Filesize
968KB

Download
memory/2268-0-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download