dridex | e65d864ac680a40fcf898cb480e6b6eb2406307973a19b5001edaedefc4b3f7b

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-09-2024 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll
Size

1.2MB
MD5

ff18e8259190c79d60bdb5e0ec552404
SHA1

ffabe6c627e7824f5ff3d10c3716f03a4ae6dea9
SHA256

e65d864ac680a40fcf898cb480e6b6eb2406307973a19b5001edaedefc4b3f7b
SHA512

30efef42d9b3874822388b4c6a8c196d518fe560cd0bb12b23f0af3ad82da90533351e518a661a91d850b968b80d505fc2ada5c9dd10127c04ab3e157b1fac47
SSDEEP

24576:auYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9N:C9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1244-5-0x0000000002540000-0x0000000002541000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
1900	psr.exe
2192	ComputerDefaults.exe
2856	rrinstaller.exe

Loads dropped DLL 7 IoCs

pid	Process
1244	Process not Found
1900	psr.exe
1244	Process not Found
2192	ComputerDefaults.exe
1244	Process not Found
2856	rrinstaller.exe
1244	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rcoehfpd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\BvmQU\\ComputerDefaults.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComputerDefaults.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rrinstaller.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	psr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2096	rundll32.exe
2096	rundll32.exe
2096	rundll32.exe
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found
1244	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2792	1244	Process not Found	31
PID 1244 wrote to memory of 2792	1244	Process not Found	31
PID 1244 wrote to memory of 2792	1244	Process not Found	31
PID 1244 wrote to memory of 1900	1244	Process not Found	32
PID 1244 wrote to memory of 1900	1244	Process not Found	32
PID 1244 wrote to memory of 1900	1244	Process not Found	32
PID 1244 wrote to memory of 2672	1244	Process not Found	33
PID 1244 wrote to memory of 2672	1244	Process not Found	33
PID 1244 wrote to memory of 2672	1244	Process not Found	33
PID 1244 wrote to memory of 2192	1244	Process not Found	34
PID 1244 wrote to memory of 2192	1244	Process not Found	34
PID 1244 wrote to memory of 2192	1244	Process not Found	34
PID 1244 wrote to memory of 2860	1244	Process not Found	35
PID 1244 wrote to memory of 2860	1244	Process not Found	35
PID 1244 wrote to memory of 2860	1244	Process not Found	35
PID 1244 wrote to memory of 2856	1244	Process not Found	36
PID 1244 wrote to memory of 2856	1244	Process not Found	36
PID 1244 wrote to memory of 2856	1244	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\ff18e8259190c79d60bdb5e0ec552404_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2096

C:\Windows\system32\psr.exe
C:\Windows\system32\psr.exe
1⤵
PID:2792

C:\Users\Admin\AppData\Local\iOmmYB\psr.exe
C:\Users\Admin\AppData\Local\iOmmYB\psr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1900

C:\Windows\system32\ComputerDefaults.exe
C:\Windows\system32\ComputerDefaults.exe
1⤵
PID:2672

C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe
C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2192

C:\Windows\system32\rrinstaller.exe
C:\Windows\system32\rrinstaller.exe
1⤵
PID:2860

C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe
C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\hoGrn5P\ComputerDefaults.exe

Filesize
36KB

MD5
86bd981f55341273753ac42ea200a81e

SHA1
14fe410efc9aeb0a905b984ac27719ff0dd10ea7

SHA256
40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

SHA512
49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

Download Submit
C:\Users\Admin\AppData\Local\hoGrn5P\appwiz.cpl

Filesize
1.2MB

MD5
0e8901e6d3c73a919736590e6a252581

SHA1
ae016e211e05ed6eaeda3767ed8d01fa477a5e7d

SHA256
b6c51115d6e9eb178ad855dfabfed9896623fea804c718cf2298ac4f2d7684c0

SHA512
a8d05136febacfffdc7b56b2508e459f49daa7008b363019e781b4f25f4727a8a72f4a1f31bbe380d9972710fcb79a7780e71bb12e97fddce0146bc45418c1ce

Download Submit
C:\Users\Admin\AppData\Local\tjMJS7\MFPlat.DLL

Filesize
1.2MB

MD5
761880a0673efe341bec445a6c6ac548

SHA1
4e977e0019e84376d93c21a64e3dcf711e7a4421

SHA256
189c669c126ac8e04910d043ce9858257c457b7bb6158ccf57e81ebf2645d3d8

SHA512
6f6b734f42db6ebbcdcf4bfd638958e25771b067f9cb2e321b657a75efcfe783106886588cce839c1cdf017802bba4d6af53396bb10c0480c36247c7e9565a5a

Download Submit
C:\Users\Admin\AppData\Local\tjMJS7\rrinstaller.exe

Filesize
54KB

MD5
0d3a73b0b30252680b383532f1758649

SHA1
9f098d2037e4dd94eca6d04c37b3d4ad8b0cc931

SHA256
fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc

SHA512
a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

Filesize
1KB

MD5
38bd488124b132d0cbe8a997577fc1cf

SHA1
b4dc89c195e93c757901643e4e3ab03359faac35

SHA256
1d23cb183be90c35e7e79e32179974e2871a7ac4a3ec73a46b4ed75c34a90d0a

SHA512
75802ea3e41a373b1f57ffdc523ae252d8482350a5dfcdc670d5f95dd745180d35b8684145d55c8c3247baa0bdd6d3a7662fe5a519e79046983378a6f88198d2

Download Submit
\Users\Admin\AppData\Local\iOmmYB\VERSION.dll

Filesize
1.2MB

MD5
bde577c36ebe4ef6b1f3532eb1bd36e2

SHA1
6c3676f6f1ef79053fa465f13e8846c27a963125

SHA256
da19a2e6c5baa31c7f9a4aecad10c30704320b0fe4a004901ca1cf35aa78159a

SHA512
59f1e554cd98f2af123c28a7fe4d10735e53be0b6cea3fed93829bd9960aa46ba67c3d9e728938d51410b434a09713e6465f958f693dcbc26c5199593d28a84c

Download Submit
\Users\Admin\AppData\Local\iOmmYB\psr.exe

Filesize
715KB

MD5
a80527109d75cba125d940b007eea151

SHA1
facf32a9ede6abfaa09368bfdfcfec8554107272

SHA256
68910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495

SHA512
77b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774

Download Submit
memory/1244-27-0x00000000773D1000-0x00000000773D2000-memory.dmp

Filesize
4KB

Download
memory/1244-47-0x00000000771C6000-0x00000000771C7000-memory.dmp

Filesize
4KB

Download
memory/1244-12-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-13-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-14-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-26-0x0000000002520000-0x0000000002527000-memory.dmp

Filesize
28KB

Download
memory/1244-25-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-17-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-16-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-15-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-28-0x0000000077560000-0x0000000077562000-memory.dmp

Filesize
8KB

Download
memory/1244-4-0x00000000771C6000-0x00000000771C7000-memory.dmp

Filesize
4KB

Download
memory/1244-37-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-38-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-5-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1244-7-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-8-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-9-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-11-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1244-10-0x0000000140000000-0x0000000140131000-memory.dmp

Filesize
1.2MB

Download
memory/1900-55-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1900-60-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

Filesize
1.2MB

Download
memory/1900-56-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

Filesize
1.2MB

Download
memory/2096-46-0x000007FEF6450000-0x000007FEF6581000-memory.dmp

Filesize
1.2MB

Download
memory/2096-1-0x000007FEF6450000-0x000007FEF6581000-memory.dmp

Filesize
1.2MB

Download
memory/2096-0-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2192-72-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2192-78-0x000007FEF6450000-0x000007FEF6582000-memory.dmp

Filesize
1.2MB

Download
memory/2856-90-0x000007FEF5F80000-0x000007FEF60B3000-memory.dmp

Filesize
1.2MB

Download
memory/2856-95-0x000007FEF5F80000-0x000007FEF60B3000-memory.dmp

Filesize
1.2MB

Download