dridex | a778300ec5f7f0660a1009be0d859897cf12b0ff1f60cd01ec2adf82aeaf5844

General

Target

ef747e43d5de3708eb4a10f4eb17f2d3_JaffaCakes118.dll
Size

1.2MB
MD5

ef747e43d5de3708eb4a10f4eb17f2d3
SHA1

2752f41170e192acc418d1b19791763326c1b363
SHA256

a778300ec5f7f0660a1009be0d859897cf12b0ff1f60cd01ec2adf82aeaf5844
SHA512

0d42f89ad6d9884b68e07af6ed9f1a19b39975b234dc4ebf5e664c484ae81ac628d396efc485e2aa0b5cc9dca7403d13adec99ec08831c18e9595819166bd08a
SSDEEP

24576:BuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NI:T9cKrUqZWLAcUw

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3388-4-0x0000000002990000-0x0000000002991000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

Processes:

rdpclip.exeCameraSettingsUIHost.exesigverif.exe

pid process

4996 rdpclip.exe
4692 CameraSettingsUIHost.exe
3988 sigverif.exe
Loads dropped DLL 3 IoCs

Processes:

rdpclip.exeCameraSettingsUIHost.exesigverif.exe

pid process

4996 rdpclip.exe
4692 CameraSettingsUIHost.exe
3988 sigverif.exe

pid	process
4996	rdpclip.exe
4692	CameraSettingsUIHost.exe
3988	sigverif.exe

pid	process
4996	rdpclip.exe
4692	CameraSettingsUIHost.exe
3988	sigverif.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wbdoaalrz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Word\\Z45rFVtbt8\\CameraSettingsUIHost.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exerdpclip.exeCameraSettingsUIHost.exesigverif.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpclip.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CameraSettingsUIHost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	sigverif.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4108	rundll32.exe
4108	rundll32.exe
4108	rundll32.exe
4108	rundll32.exe
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388
3388

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3388 wrote to memory of 2292	3388	rdpclip.exe
PID 3388 wrote to memory of 2292	3388	rdpclip.exe
PID 3388 wrote to memory of 4996	3388	rdpclip.exe
PID 3388 wrote to memory of 4996	3388	rdpclip.exe
PID 3388 wrote to memory of 3076	3388	CameraSettingsUIHost.exe
PID 3388 wrote to memory of 3076	3388	CameraSettingsUIHost.exe
PID 3388 wrote to memory of 4692	3388	CameraSettingsUIHost.exe
PID 3388 wrote to memory of 4692	3388	CameraSettingsUIHost.exe
PID 3388 wrote to memory of 2904	3388	sigverif.exe
PID 3388 wrote to memory of 2904	3388	sigverif.exe
PID 3388 wrote to memory of 3988	3388	sigverif.exe
PID 3388 wrote to memory of 3988	3388	sigverif.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ef747e43d5de3708eb4a10f4eb17f2d3_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4108

C:\Windows\system32\rdpclip.exe
C:\Windows\system32\rdpclip.exe
1⤵
PID:2292

C:\Users\Admin\AppData\Local\3UyacYbfA\rdpclip.exe
C:\Users\Admin\AppData\Local\3UyacYbfA\rdpclip.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4996

C:\Windows\system32\CameraSettingsUIHost.exe
C:\Windows\system32\CameraSettingsUIHost.exe
1⤵
PID:3076

C:\Users\Admin\AppData\Local\Sd9SN\CameraSettingsUIHost.exe
C:\Users\Admin\AppData\Local\Sd9SN\CameraSettingsUIHost.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4692

C:\Windows\system32\sigverif.exe
C:\Windows\system32\sigverif.exe
1⤵
PID:2904

C:\Users\Admin\AppData\Local\n7OvBFQv\sigverif.exe
C:\Users\Admin\AppData\Local\n7OvBFQv\sigverif.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\3UyacYbfA\dwmapi.dll

Filesize
1.2MB

MD5
fca1423462fce7e70b720b046eda2105

SHA1
c6ec752b4224f2cb022253d76f725510b66e7065

SHA256
735149cee9de8071d8418e00da6c2a6caed069924d5e04e79d93b54936834672

SHA512
5ef8d56f7cf13d92e62f7776416d2dbfe224894fdb794a1aaa6f921c82d7f0b69d358d0ac153df21cd94663892dd18d26b5310949e9cdf6162023adba556b21c

Download Submit
C:\Users\Admin\AppData\Local\3UyacYbfA\rdpclip.exe

Filesize
446KB

MD5
a52402d6bd4e20a519a2eeec53332752

SHA1
129f2b6409395ef877b9ca39dd819a2703946a73

SHA256
9d5be181d9309dea98039d2ce619afe745fc8a9a1b1c05cf860b3620b5203308

SHA512
632dda67066cff2b940f27e3f409e164684994a02bda57d74e958c462b9a0963e922be4a487c06126cecc9ef34d34913ef8315524bf8422f83c0c135b8af924e

Download Submit
C:\Users\Admin\AppData\Local\Sd9SN\CameraSettingsUIHost.exe

Filesize
31KB

MD5
9e98636523a653c7a648f37be229cf69

SHA1
bd4da030e7cf4d55b7c644dfacd26b152e6a14c4

SHA256
3bf20bc5a208dfa1ea26a042fd0010b1268dcfedc94ed775f11890bc1d95e717

SHA512
41966166e2ddfe40e6f4e6da26bc490775caac9997465c6dd94ba6a664d3a797ffc2aa5684c95702e8657e5cea62a46a75aee3e7d5e07a47dcaaa5c4da565e78

Download Submit
C:\Users\Admin\AppData\Local\Sd9SN\DUI70.dll

Filesize
1.4MB

MD5
99f56e159299914bf6621ea3865009dd

SHA1
0e5abf62e94d8ba7c92bd2291dc7542e15ecc0c9

SHA256
7ddd2059294f8bb1349d0014b5a7b0dc2f4ca7d9387f089615d9902aa6d1a5fe

SHA512
0ed54f26da4242643f01952ee371347699944360b317bb4660a00aa0ef36d32169e1ad8cbde084e2e8761001d5fabd731aae981d5dd2dc8394767292afeeb4f0

Download Submit
C:\Users\Admin\AppData\Local\n7OvBFQv\VERSION.dll

Filesize
1.2MB

MD5
d5a131761cb499dd3eb7d24c939dd325

SHA1
20d892f66e0594d27da4ec669349c1143a8cdd14

SHA256
3e316cd4f74758af2f2b38d889841b5d19e0668f20b87efae64a5d8e89876db4

SHA512
46fa6ba80e76583b205d98d645e4770cc18c7eda971d22176fba441bde261404e82b34b7c700d41b18ab88ddc0e0cfdbb92abebf54600894ae6c0fdb38541345

Download Submit
C:\Users\Admin\AppData\Local\n7OvBFQv\sigverif.exe

Filesize
77KB

MD5
2151a535274b53ba8a728e542cbc07a8

SHA1
a2304c0f2616a7d12298540dce459dd9ccf07443

SHA256
064de47877b00dc35886e829a697e4adb3d3cfdf294ddba13b6009a0f415b1bd

SHA512
e6fd520ee1bd80a5fe8a7c2ae6446dcaabd4e335a602c36356f85305abef751b7dffa7eaac1ec13c105ccd8c3e9070bd32ed4b14bc8a9e52dc5f47b936d69a9f

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mihblavoyj.lnk

Filesize
1KB

MD5
9fe1212c416cec9ef2bc35d28dc8c184

SHA1
f91ea4218da3325fc710fef9d71c58cf86e7aa44

SHA256
281c34700f50656727047d216d6713e9dd68f5454eea7936ba7fcb6dba0be443

SHA512
6ddbf1f4664c26640f50b1bd77df4f9181d405ebeac7a3da6a0491f2586331d3aed622976c7ecff07a2a99e07156c4166152e9ac70892f05265247642bb31bef

Download Submit
memory/3388-24-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-29-0x00007FF93E990000-0x00007FF93E9A0000-memory.dmp

Filesize
64KB

Download
memory/3388-16-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-15-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-13-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-12-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-11-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-10-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-9-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-8-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-35-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-6-0x00007FF93D63A000-0x00007FF93D63B000-memory.dmp

Filesize
4KB

Download
memory/3388-27-0x0000000000740000-0x0000000000747000-memory.dmp

Filesize
28KB

Download
memory/3388-4-0x0000000002990000-0x0000000002991000-memory.dmp

Filesize
4KB

Download
memory/3388-7-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3388-14-0x0000000140000000-0x0000000140130000-memory.dmp

Filesize
1.2MB

Download
memory/3988-82-0x00000213E9240000-0x00000213E9247000-memory.dmp

Filesize
28KB

Download
memory/3988-85-0x00007FF920900000-0x00007FF920A31000-memory.dmp

Filesize
1.2MB

Download
memory/4108-0-0x0000025A4A8B0000-0x0000025A4A8B7000-memory.dmp

Filesize
28KB

Download
memory/4108-38-0x00007FF92FE80000-0x00007FF92FFB0000-memory.dmp

Filesize
1.2MB

Download
memory/4108-1-0x00007FF92FE80000-0x00007FF92FFB0000-memory.dmp

Filesize
1.2MB

Download
memory/4692-65-0x000001F646CB0000-0x000001F646CB7000-memory.dmp

Filesize
28KB

Download
memory/4692-62-0x00007FF9208C0000-0x00007FF920A36000-memory.dmp

Filesize
1.5MB

Download
memory/4692-68-0x00007FF9208C0000-0x00007FF920A36000-memory.dmp

Filesize
1.5MB

Download
memory/4996-51-0x00007FF920900000-0x00007FF920A31000-memory.dmp

Filesize
1.2MB

Download
memory/4996-46-0x00007FF920900000-0x00007FF920A31000-memory.dmp

Filesize
1.2MB

Download
memory/4996-45-0x000001A79C740000-0x000001A79C747000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads