dridex | 2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073

General

Target

2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll
Size

936KB
MD5

bfcdafe69d90bd7023f8ad9a3010387e
SHA1

7fa6a02a6a2ded8ec7146ea384f61c9fa0dd783d
SHA256

2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073
SHA512

1a5f3d120c40656d9b8d44f21afbe4841426ff12c0b72e9ef9f493e2c519ae430bd631e3da7cfe90afe8c50e6096215d4dc898044f66922123f210024f46082e
SSDEEP

12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1196-4-0x0000000002CF0000-0x0000000002CF1000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2544-0-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-23-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-35-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-34-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/2544-43-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/2860-53-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/2860-57-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/2696-70-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/2696-73-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/2944-95-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

lpksetup.exemmc.exerstrui.exe

pid process

2860 lpksetup.exe
2696 mmc.exe
2944 rstrui.exe
Loads dropped DLL 7 IoCs

Processes:

lpksetup.exemmc.exerstrui.exe

pid process

1196
2860 lpksetup.exe
1196
2696 mmc.exe
1196
2944 rstrui.exe
1196

pid	process
2860	lpksetup.exe
2696	mmc.exe
2944	rstrui.exe

pid	process
1196
2860	lpksetup.exe
1196
2696	mmc.exe
1196
2944	rstrui.exe
1196

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dnfwvyvycst = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\Recent\\HyzXqtd\\mmc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

lpksetup.exemmc.exerstrui.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lpksetup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mmc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rstrui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2544	rundll32.exe
2544	rundll32.exe
2544	rundll32.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1196 wrote to memory of 2964	1196	lpksetup.exe
PID 1196 wrote to memory of 2964	1196	lpksetup.exe
PID 1196 wrote to memory of 2964	1196	lpksetup.exe
PID 1196 wrote to memory of 2860	1196	lpksetup.exe
PID 1196 wrote to memory of 2860	1196	lpksetup.exe
PID 1196 wrote to memory of 2860	1196	lpksetup.exe
PID 1196 wrote to memory of 2628	1196	mmc.exe
PID 1196 wrote to memory of 2628	1196	mmc.exe
PID 1196 wrote to memory of 2628	1196	mmc.exe
PID 1196 wrote to memory of 2696	1196	mmc.exe
PID 1196 wrote to memory of 2696	1196	mmc.exe
PID 1196 wrote to memory of 2696	1196	mmc.exe
PID 1196 wrote to memory of 2948	1196	rstrui.exe
PID 1196 wrote to memory of 2948	1196	rstrui.exe
PID 1196 wrote to memory of 2948	1196	rstrui.exe
PID 1196 wrote to memory of 2944	1196	rstrui.exe
PID 1196 wrote to memory of 2944	1196	rstrui.exe
PID 1196 wrote to memory of 2944	1196	rstrui.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\2f16358833b2414eeec6ca8512176982cb9ee1797ea131039e21bc187989e073.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2544

C:\Windows\system32\lpksetup.exe
C:\Windows\system32\lpksetup.exe
1⤵
PID:2964

C:\Users\Admin\AppData\Local\IJveok9vA\lpksetup.exe
C:\Users\Admin\AppData\Local\IJveok9vA\lpksetup.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2860

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe
1⤵
PID:2628

C:\Users\Admin\AppData\Local\Bnkev\mmc.exe
C:\Users\Admin\AppData\Local\Bnkev\mmc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2696

C:\Windows\system32\rstrui.exe
C:\Windows\system32\rstrui.exe
1⤵
PID:2948

C:\Users\Admin\AppData\Local\avW1U\rstrui.exe
C:\Users\Admin\AppData\Local\avW1U\rstrui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Bnkev\mmcbase.DLL

Filesize
944KB

MD5
c0fa3144f8540622bf5cf79f2f113ac5

SHA1
c2c91c40a4fdedc8147d9ad44572b07ff8c696c0

SHA256
b8b4e0dfde44de51caabbe859d254239c4933f3aaa377dab6ca3247bd5da8c38

SHA512
dd03176ed87078e6f025be6484156c38b2a637dc16af6fea1a31918664b79b6cf9e2a0af20498e995cf132f4b56f6237ee9b889bd7b5dc3f6f6e73b11ac166c6

Download Submit
C:\Users\Admin\AppData\Local\IJveok9vA\dpx.dll

Filesize
940KB

MD5
59bc65a4ee608dd54239a559890a9db0

SHA1
06884b12cde7336da92185023eae5fa8d947e6fc

SHA256
02a34a3b80afd7535faaddeb0216915e970dc20cd8027e56043c574d47a39df6

SHA512
ca6e2a8533000641af46a218fb3de732a257e2abb085d0c9e2a06e6673dcf73e5f9faf2bd141a7d2fcaca39061d88e324608563a65184a2549a5abe1e452cb55

Download Submit
C:\Users\Admin\AppData\Local\IJveok9vA\lpksetup.exe

Filesize
638KB

MD5
50d28f3f8b7c17056520c80a29efe17c

SHA1
1b1e62be0a0bdc9aec2e91842c35381297d8f01e

SHA256
71613ea48467d1a0b00f8bcaed270b7527fc5771f540a8eb0515b3a5fdc8604f

SHA512
92bc60402aacf1a62e47335adf8696a5c0d31637e624628d82b6ec1f17e1ee65ae8edf7e8dcd10933f59c892a4a74d8e461945df0991b706a4a53927c5fd3861

Download Submit
C:\Users\Admin\AppData\Local\avW1U\SPP.dll

Filesize
940KB

MD5
8dea4ab46ec51b282492ed5884a70157

SHA1
35e14f9a396454a9a64ad32648bc87df311ca6ae

SHA256
49cdb4f3a4a75e4a3894714b4c406001151530dc545e7041119d22353d4d2cd0

SHA512
4935a5d8b1ab45ce663fab61d8b5fe8064c6041fd0d270a103ca8aac56f9e849f22adc43219796a6da73f6bdd8528f6825f8ee07bfcfae7d76c0ef0640301c4a

Download Submit
C:\Users\Admin\AppData\Local\avW1U\rstrui.exe

Filesize
290KB

MD5
3db5a1eace7f3049ecc49fa64461e254

SHA1
7dc64e4f75741b93804cbae365e10dc70592c6a9

SHA256
ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49

SHA512
ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ncfyujonfo.lnk

Filesize
1KB

MD5
1072dd5fa7057b438e6d75cad71d05dc

SHA1
353160c04cc2672e1912914d49e254cfe010e8d0

SHA256
56769fb0b3803d55fe567cc5f171ddf5b1314542c8a2b8903d54b716838cf4a5

SHA512
13c717a0f54c4b33c881c356805f1798b8a9aa92173056ca1ac26810fbb121bc73cdf49f3bd856a1baf78d8e897e120149f5a560d220f8185bf9c71b51ddc9f0

Download Submit
\Users\Admin\AppData\Local\Bnkev\mmc.exe

Filesize
2.0MB

MD5
9fea051a9585f2a303d55745b4bf63aa

SHA1
f5dc12d658402900a2b01af2f018d113619b96b8

SHA256
b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484

SHA512
beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76

Download Submit
memory/1196-9-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-44-0x0000000076E36000-0x0000000076E37000-memory.dmp

Filesize
4KB

Download
memory/1196-25-0x00000000770D0000-0x00000000770D2000-memory.dmp

Filesize
8KB

Download
memory/1196-24-0x00000000770A0000-0x00000000770A2000-memory.dmp

Filesize
8KB

Download
memory/1196-23-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-12-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-10-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-35-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-34-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-3-0x0000000076E36000-0x0000000076E37000-memory.dmp

Filesize
4KB

Download
memory/1196-8-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-22-0x0000000002CD0000-0x0000000002CD7000-memory.dmp

Filesize
28KB

Download
memory/1196-4-0x0000000002CF0000-0x0000000002CF1000-memory.dmp

Filesize
4KB

Download
memory/1196-11-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-13-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-14-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-6-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-7-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2544-43-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2544-2-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2544-0-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2696-69-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/2696-70-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download
memory/2696-73-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download
memory/2860-57-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/2860-52-0x0000000000380000-0x0000000000387000-memory.dmp

Filesize
28KB

Download
memory/2860-53-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/2944-95-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads