dridex | cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 02:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0880db875d3faf856245d738b7e0a25a_JaffaCakes118.dll
Size

2.4MB
MD5

0880db875d3faf856245d738b7e0a25a
SHA1

38d0242a90bdc46d7cf3bf3a1b5e0013c23ba0a1
SHA256

cb658c7c3861a3dd49828120e24c44096aef25e1bc1d14a8617d59a281f29fed
SHA512

8696984083fcbe4426976bcb9d6793f6d8653572f747e5095c5413a4ea60a985d54c6fc421a6622d0e3a66b1c4df8069aafc39f2ab88c0aecfbe9f4fed1a56e1
SSDEEP

12288:yQVI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1AZ:ufP7fWsK5z9A+WGAW+V5SB6Ct4bnb

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral2/memory/3444-4-0x0000000000710000-0x0000000000711000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
3440	DWWIN.EXE
972	MusNotifyIcon.exe
3268	DmNotificationBroker.exe

Loads dropped DLL 3 IoCs

pid	Process
3440	DWWIN.EXE
972	MusNotifyIcon.exe
3268	DmNotificationBroker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Isybexcquevfui = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\NATIVE~1\\0SL4CX~1\\MUSNOT~1.EXE"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DmNotificationBroker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DWWIN.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3308	rundll32.exe
3308	rundll32.exe
3308	rundll32.exe
3308	rundll32.exe
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found
3444	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 2212	3444	Process not Found	86
PID 3444 wrote to memory of 2212	3444	Process not Found	86
PID 3444 wrote to memory of 3440	3444	Process not Found	87
PID 3444 wrote to memory of 3440	3444	Process not Found	87
PID 3444 wrote to memory of 1492	3444	Process not Found	88
PID 3444 wrote to memory of 1492	3444	Process not Found	88
PID 3444 wrote to memory of 972	3444	Process not Found	89
PID 3444 wrote to memory of 972	3444	Process not Found	89
PID 3444 wrote to memory of 2976	3444	Process not Found	90
PID 3444 wrote to memory of 2976	3444	Process not Found	90
PID 3444 wrote to memory of 3268	3444	Process not Found	91
PID 3444 wrote to memory of 3268	3444	Process not Found	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\0880db875d3faf856245d738b7e0a25a_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3308

C:\Windows\system32\DWWIN.EXE
C:\Windows\system32\DWWIN.EXE
1⤵
PID:2212

C:\Users\Admin\AppData\Local\MIU\DWWIN.EXE
C:\Users\Admin\AppData\Local\MIU\DWWIN.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3440

C:\Windows\system32\MusNotifyIcon.exe
C:\Windows\system32\MusNotifyIcon.exe
1⤵
PID:1492

C:\Users\Admin\AppData\Local\K9Ab\MusNotifyIcon.exe
C:\Users\Admin\AppData\Local\K9Ab\MusNotifyIcon.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:972

C:\Windows\system32\DmNotificationBroker.exe
C:\Windows\system32\DmNotificationBroker.exe
1⤵
PID:2976

C:\Users\Admin\AppData\Local\WO8Fg4Hp\DmNotificationBroker.exe
C:\Users\Admin\AppData\Local\WO8Fg4Hp\DmNotificationBroker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\K9Ab\MusNotifyIcon.exe

Filesize
629KB

MD5
c54b1a69a21e03b83ebb0aeb3758b6f7

SHA1
b32ee7e5b813554c4b8e8f96f176570e0f6e8b6c

SHA256
ac3e12011b70144cc84539bbccacdfae35bd4ea3ee61b4a9fca5f082d044d8bf

SHA512
2680ab501ffe7d40fed28eb207d812880c8a71d71a29d59ba3da27c0bae98c74893e04807d93fba7b5e673c3e13a1ad21bfaab10bdb871d83349ff4e7c614b19

Download Submit
C:\Users\Admin\AppData\Local\K9Ab\UxTheme.dll

Filesize
2.4MB

MD5
9ba2efa9bd631845aded0dca63c12564

SHA1
d5f5aba6d2ac23acf004a87b959a5e404e1be69a

SHA256
e8352465f330b29c12aa44af2b8d576a0caa740bf8d0ae57b88593af48d2b233

SHA512
a79b643dbad5daecbbe6b057b2fffd1c18b438f5a83f4708b1b86b392d54e6f5aeef47dfbe786d80424f41e3826dd284fe5e3f2f4162d73b289570a9e5429fe9

Download Submit
C:\Users\Admin\AppData\Local\MIU\DWWIN.EXE

Filesize
229KB

MD5
444cc4d3422a0fdd45c1b78070026c60

SHA1
97162ff341fff1ec54b827ec02f8b86fd2d41a97

SHA256
4b3f620272e709ce3e01ae5b19ef0300bd476f2da6412637f703bbaded2821f0

SHA512
21742d330a6a5763ea41a8fed4d71b98e4a1b4c685675c4cfeb7253033c3a208c23902caf0efdf470a85e0770cb8fac8af0eb6d3a8511445b0570054b42d5553

Download Submit
C:\Users\Admin\AppData\Local\MIU\VERSION.dll

Filesize
2.4MB

MD5
8d690d39cf823f44e68bb74e93995922

SHA1
a3a67813c6c1063fa34259707954e30632a725ae

SHA256
6642d17af8e767da6a301d8013c87322ac2137567d6a40cb60d197f49ca6d0fb

SHA512
cbfd1ecde09b90df946c57fbd820d46df18394d69385e570060ec56a5901d8084c1e5d51ac9f477c7d89c42d22620bba9e48d62cfb3934d7ea3d11e7be9f4926

Download Submit
C:\Users\Admin\AppData\Local\WO8Fg4Hp\DUI70.dll

Filesize
2.7MB

MD5
7361199dfd66f74630621f8c2e008fe9

SHA1
50931d73e1a50396c4932f70e4062fa91337745a

SHA256
6336f73c5ae104af04ee7d76cf0994f2df0fe8d30e4c52dbdd73effd426bc5ba

SHA512
1df6516e0b3ba654a18086a867bf8263ce87ae6c68e2c85526ce59fe3bc70b57581870f02659e31c4d33a71212606dc8a708a2604fba4cc5ab0311caed6882c9

Download Submit
C:\Users\Admin\AppData\Local\WO8Fg4Hp\DmNotificationBroker.exe

Filesize
32KB

MD5
f0bdc20540d314a2aad951c7e2c88420

SHA1
4ab344595a4a81ab5f31ed96d72f217b4cee790b

SHA256
f87537e5f26193a2273380f86cc9ac16d977f65b0eff2435e40be830fd99f7b5

SHA512
cb69e35b2954406735264a4ae8fe1eca1bd4575f553ab2178c70749ab997bda3c06496d2fce97872c51215a19093e51eea7cc8971af62ad9d5726f3a0d2730aa

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wyfsbgf.lnk

Filesize
1KB

MD5
0c5198ddf78ed3044fd245e5ddde83fc

SHA1
448c5c2db88e0257cfc92aa1456d751d166997b9

SHA256
1676b8ad2c401ceaaebbd75e09444a84ba4f3246c6bdda8421d14155280980a8

SHA512
aeb41d5b0b29e39b59884a43c7039ea780bb2c5751fc77ac7820a291ea42c249fbe23002e1ab7161549448a69ab05acd500370200bb11b2a9ae7c34851577d96

Download Submit
memory/972-112-0x00000216F1D70000-0x00000216F1D77000-memory.dmp

Filesize
28KB

Download
memory/3268-129-0x0000021749B80000-0x0000021749B87000-memory.dmp

Filesize
28KB

Download
memory/3308-0-0x000002330EAA0000-0x000002330EAA7000-memory.dmp

Filesize
28KB

Download
memory/3308-1-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3308-9-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3440-97-0x0000019A2A5D0000-0x0000019A2A5D7000-memory.dmp

Filesize
28KB

Download
memory/3444-31-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-25-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-57-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-56-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-55-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-54-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-53-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-51-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-50-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-49-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-48-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-47-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-45-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-44-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-43-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-42-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-41-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-39-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-38-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-36-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-35-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-34-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-33-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-59-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-29-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-30-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-28-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-27-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-24-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-58-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-23-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-21-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-22-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-20-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-19-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-18-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-16-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-15-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-14-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-13-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-12-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-11-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-61-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-60-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-52-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-46-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-40-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-37-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-32-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-17-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-10-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-8-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-7-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-62-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-87-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/3444-88-0x00007FFB35AE0000-0x00007FFB35AF0000-memory.dmp

Filesize
64KB

Download
memory/3444-63-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-26-0x0000000140000000-0x0000000140264000-memory.dmp

Filesize
2.4MB

Download
memory/3444-4-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3444-5-0x00007FFB3462A000-0x00007FFB3462B000-memory.dmp

Filesize
4KB

Download