dridex | 7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544

General

Target

7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544.dll
Size

936KB
MD5

e6080347ef82059989855367f707b6f5
SHA1

af2f5c40bdd1b55fde1fab97d91e5e7e12733731
SHA256

7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544
SHA512

6a58fb67a3cc61fdccbe8335309964d1c2d2cc9db2d1e47797fa0ba2de69631f71ba4499e9b65d921846832f33e358356ac917f836616d6a0d08209767f1c82b
SSDEEP

12288:DPVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:DtKTrsKSKBTSb6DUXWq8

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1196-4-0x0000000002E20000-0x0000000002E21000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2308-0-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-23-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-35-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1196-36-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/2308-43-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/2632-53-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/2632-57-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/2792-69-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/2792-73-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/3000-89-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

rdpshell.exeslui.exeTpmInit.exe

pid process

2632 rdpshell.exe
2792 slui.exe
3000 TpmInit.exe
Loads dropped DLL 7 IoCs

Processes:

rdpshell.exeslui.exeTpmInit.exe

pid process

1196
2632 rdpshell.exe
1196
2792 slui.exe
1196
3000 TpmInit.exe
1196

pid	process
2632	rdpshell.exe
2792	slui.exe
3000	TpmInit.exe

pid	process
1196
2632	rdpshell.exe
1196
2792	slui.exe
1196
3000	TpmInit.exe
1196

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kccgsbu = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\3Ong\\slui.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rdpshell.exeslui.exeTpmInit.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpshell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TpmInit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2308	rundll32.exe
2308	rundll32.exe
2308	rundll32.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1196 wrote to memory of 2948	1196	rdpshell.exe
PID 1196 wrote to memory of 2948	1196	rdpshell.exe
PID 1196 wrote to memory of 2948	1196	rdpshell.exe
PID 1196 wrote to memory of 2632	1196	rdpshell.exe
PID 1196 wrote to memory of 2632	1196	rdpshell.exe
PID 1196 wrote to memory of 2632	1196	rdpshell.exe
PID 1196 wrote to memory of 2340	1196	slui.exe
PID 1196 wrote to memory of 2340	1196	slui.exe
PID 1196 wrote to memory of 2340	1196	slui.exe
PID 1196 wrote to memory of 2792	1196	slui.exe
PID 1196 wrote to memory of 2792	1196	slui.exe
PID 1196 wrote to memory of 2792	1196	slui.exe
PID 1196 wrote to memory of 1440	1196	TpmInit.exe
PID 1196 wrote to memory of 1440	1196	TpmInit.exe
PID 1196 wrote to memory of 1440	1196	TpmInit.exe
PID 1196 wrote to memory of 3000	1196	TpmInit.exe
PID 1196 wrote to memory of 3000	1196	TpmInit.exe
PID 1196 wrote to memory of 3000	1196	TpmInit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\7ecf0f43a5389996d85ecc78bd128506009eca558379d5fb8802037b35da1544.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Windows\system32\rdpshell.exe
C:\Windows\system32\rdpshell.exe
1⤵
PID:2948

C:\Users\Admin\AppData\Local\kHd1m\rdpshell.exe
C:\Users\Admin\AppData\Local\kHd1m\rdpshell.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2632

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:2340

C:\Users\Admin\AppData\Local\benmf7yv\slui.exe
C:\Users\Admin\AppData\Local\benmf7yv\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2792

C:\Windows\system32\TpmInit.exe
C:\Windows\system32\TpmInit.exe
1⤵
PID:1440

C:\Users\Admin\AppData\Local\v7P\TpmInit.exe
C:\Users\Admin\AppData\Local\v7P\TpmInit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\benmf7yv\WINBRAND.dll

Filesize
940KB

MD5
66f36b25cf699f0ec3c676cc714f822d

SHA1
44133d1035db4726202148e2a04d9f7e36e054df

SHA256
03966c7bff087a007c04e0dbb06b47f17e87bd0487b04768465d399c11478a54

SHA512
68c4a67edeeebbeab9459a1239b2cde22645a01f18eb2c3f870fe7d8cf8d554ffbe03800d7b12fc3dde53817fb46375e565e3f7d886f56fa548765067b13b9fc

Download Submit
C:\Users\Admin\AppData\Local\kHd1m\WINSTA.dll

Filesize
944KB

MD5
510c41b8b0e6065b7b7d38ef9478393a

SHA1
fc78edc740f48f2ed20db2c4c8eb55d09d4dc8af

SHA256
9279fede83e1f57f3289f3d77203cf0eff93602494e49281a79b73e0fcdd377e

SHA512
920a5a871a3eb9d1ff7e0c1769f9bda1699d5fa7f159344c1eb6a98f10b59b6dd657d6791dceac25030241efb825ec717bd46c3aeb095d519dc257d07122bc41

Download Submit
C:\Users\Admin\AppData\Local\v7P\ACTIVEDS.dll

Filesize
940KB

MD5
1f86533ab10626cbb6cd2772a1a5ca0a

SHA1
db043bc2cc8c0233473a07c8a9c3caed094cf8ee

SHA256
abb2a5efc453a52b6c3101bb75bf38582879486e798abf1b558fa292e44cc4bf

SHA512
df3c6f5d5dfbbb8ccf13e61df0c8b7c047260336dffdd98d782fe7da4f03ff2281a3d4ce3cbeafdc713fbdc70dc9e442caf97ce89c2634201e37133c715c91f1

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Lcuygmmobxhxaxh.lnk

Filesize
1KB

MD5
453b49cc4af36d37353a748ce98f345f

SHA1
2edc3be9c9301e041c91c498f9232263489ee10a

SHA256
d53533166df442c7a6e09880065a6be0b9e6d6a9538ed4b7ab8e94e5b17763f2

SHA512
c55371b6d82cdb59926bee58225cb63d841e624c119de40db09673ca22e125bab3a743e5f29b93b2f7537a10ef98f746c870d068b5fdf0f39023d9eb02936ed9

Download Submit
\Users\Admin\AppData\Local\benmf7yv\slui.exe

Filesize
341KB

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
\Users\Admin\AppData\Local\kHd1m\rdpshell.exe

Filesize
292KB

MD5
a62dfcea3a58ba8fcf32f831f018fe3f

SHA1
75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b

SHA256
f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e

SHA512
9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

Download Submit
\Users\Admin\AppData\Local\v7P\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
memory/1196-24-0x0000000077730000-0x0000000077732000-memory.dmp

Filesize
8KB

Download
memory/1196-44-0x00000000773C6000-0x00000000773C7000-memory.dmp

Filesize
4KB

Download
memory/1196-10-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-22-0x0000000002E00000-0x0000000002E07000-memory.dmp

Filesize
28KB

Download
memory/1196-14-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-23-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-13-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-12-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-25-0x0000000077760000-0x0000000077762000-memory.dmp

Filesize
8KB

Download
memory/1196-3-0x00000000773C6000-0x00000000773C7000-memory.dmp

Filesize
4KB

Download
memory/1196-35-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-36-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-4-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/1196-6-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-11-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-7-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-9-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1196-8-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2308-43-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2308-2-0x0000000000330000-0x0000000000337000-memory.dmp

Filesize
28KB

Download
memory/2308-0-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2632-57-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download
memory/2632-53-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download
memory/2632-52-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2792-69-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/2792-73-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/3000-89-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads