dridex | bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 20:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774.dll
Size

936KB
MD5

401f84a3215161405db7ecf1f1d0b6f4
SHA1

7b2517a60daac43ab7d5f12f3c5f10c40221c46d
SHA256

bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774
SHA512

3b4598da32edd45909e44067d8fd0aa65a30d21deb908c2ba0a7e2ee1f1d9b4e362161238c47305fecfd36f38a99da9d39d0f1e242ae337d8fc4525eac96b183
SSDEEP

12288:3PVKLvdxQPKSoVXxTaGcb68Uzx2TBeOWhZJpK8:3tKTrsKSKBTSb6DUXWq8

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1368-4-0x0000000002A30000-0x0000000002A31000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral1/memory/1840-0-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1368-23-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1368-34-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1368-35-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/1840-43-0x0000000140000000-0x00000001400EA000-memory.dmp	dridex_payload
behavioral1/memory/2620-52-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/2620-57-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload
behavioral1/memory/2644-69-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/2644-74-0x0000000140000000-0x00000001400EC000-memory.dmp	dridex_payload
behavioral1/memory/1620-90-0x0000000140000000-0x00000001400EB000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

pid	Process
2620	MpSigStub.exe
2644	rdpshell.exe
1620	EhStorAuthn.exe

Loads dropped DLL 7 IoCs

pid	Process
1368	Process not Found
2620	MpSigStub.exe
1368	Process not Found
2644	rdpshell.exe
1368	Process not Found
1620	EhStorAuthn.exe
1368	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgvptlq = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\SendTo\\36k\\rdpshell.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpshell.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EhStorAuthn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1840	rundll32.exe
1840	rundll32.exe
1840	rundll32.exe
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found
1368	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 3036	1368	Process not Found	31
PID 1368 wrote to memory of 3036	1368	Process not Found	31
PID 1368 wrote to memory of 3036	1368	Process not Found	31
PID 1368 wrote to memory of 2620	1368	Process not Found	32
PID 1368 wrote to memory of 2620	1368	Process not Found	32
PID 1368 wrote to memory of 2620	1368	Process not Found	32
PID 1368 wrote to memory of 2240	1368	Process not Found	33
PID 1368 wrote to memory of 2240	1368	Process not Found	33
PID 1368 wrote to memory of 2240	1368	Process not Found	33
PID 1368 wrote to memory of 2644	1368	Process not Found	34
PID 1368 wrote to memory of 2644	1368	Process not Found	34
PID 1368 wrote to memory of 2644	1368	Process not Found	34
PID 1368 wrote to memory of 2900	1368	Process not Found	35
PID 1368 wrote to memory of 2900	1368	Process not Found	35
PID 1368 wrote to memory of 2900	1368	Process not Found	35
PID 1368 wrote to memory of 1620	1368	Process not Found	36
PID 1368 wrote to memory of 1620	1368	Process not Found	36
PID 1368 wrote to memory of 1620	1368	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\bb17e954d051478ae93df3251a7c0aac723ba6d07fbbd1da9e4172d08041b774.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1840

C:\Windows\system32\MpSigStub.exe
C:\Windows\system32\MpSigStub.exe
1⤵
PID:3036

C:\Users\Admin\AppData\Local\0THIO6eN\MpSigStub.exe
C:\Users\Admin\AppData\Local\0THIO6eN\MpSigStub.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2620

C:\Windows\system32\rdpshell.exe
C:\Windows\system32\rdpshell.exe
1⤵
PID:2240

C:\Users\Admin\AppData\Local\LWY7FZp\rdpshell.exe
C:\Users\Admin\AppData\Local\LWY7FZp\rdpshell.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2644

C:\Windows\system32\EhStorAuthn.exe
C:\Windows\system32\EhStorAuthn.exe
1⤵
PID:2900

C:\Users\Admin\AppData\Local\MIoY7\EhStorAuthn.exe
C:\Users\Admin\AppData\Local\MIoY7\EhStorAuthn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0THIO6eN\VERSION.dll

Filesize
940KB

MD5
ad81a7163d065e08f7cf59c33d50df10

SHA1
7d0e5d25e08a240940e8f88f4007c79c50125e5c

SHA256
b3d95e592f1d43ec228578d88093dfb8aa4467d366d7200c063dd122cf88dfd5

SHA512
094f3b17a36a88354657fd101960a358dee5c42017bb3fd11fd1660d6d08726482055eaf27f90f6b3e58a5413c23dde18930c3242265a2d8edf80c888c66d7bc

Download Submit
C:\Users\Admin\AppData\Local\LWY7FZp\WINSTA.dll

Filesize
944KB

MD5
9d0eb2289d75f716597a3bdf75c55923

SHA1
fbb616997f2d7114a3009a2aafb1416f3172fa89

SHA256
c2ee138993d4f131b0f35f98afa44469d12ad1ef0045e554020bba5031512ae3

SHA512
f1638d8efeddaaf9838aca5004a842bc8d9b54d0591c68ac68aa78ca6b98a2b4cd361ab474790c9cbcf67fe6c9d556901c885090e004ac89a902d964ba52c3ef

Download Submit
C:\Users\Admin\AppData\Local\MIoY7\WTSAPI32.dll

Filesize
940KB

MD5
262667bd1055960d7e90962627d5c182

SHA1
73ed7e6c598515f0690b8b5cb42318740ff8edac

SHA256
4e1ebcdc3e63ca325e4a6a89992369507740e9ecae7e4acab19199bea41b9cbc

SHA512
f4d724afe06e7c0f4ff63b61a4660c22fd8b295cd504d8988cd249284b46b087f3617aad64d4a588e7d02e397e0d67cb517fdefdeaf1244ce694ea9508dd9887

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

Filesize
1015B

MD5
d1c845c3e7c7698006a8729ead993169

SHA1
6724f2d3aca674e36510efe5f0bc053db839eac8

SHA256
42a9f890ea48ce539a48a13acd33fef9c00e4fb56684b85bbc8822842f055140

SHA512
0083506e3607e79dd913613c8b588c0af09d16178cd97880e50ae44de25073d5ed6adfc50e0f6ca1062939fc283091abdde03d69be814da046513bd843a223f4

Download Submit
\Users\Admin\AppData\Local\0THIO6eN\MpSigStub.exe

Filesize
264KB

MD5
2e6bd16aa62e5e95c7b256b10d637f8f

SHA1
350be084477b1fe581af83ca79eb58d4defe260f

SHA256
d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3

SHA512
1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

Download Submit
\Users\Admin\AppData\Local\LWY7FZp\rdpshell.exe

Filesize
292KB

MD5
a62dfcea3a58ba8fcf32f831f018fe3f

SHA1
75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b

SHA256
f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e

SHA512
9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

Download Submit
\Users\Admin\AppData\Local\MIoY7\EhStorAuthn.exe

Filesize
137KB

MD5
3abe95d92c80dc79707d8e168d79a994

SHA1
64b10c17f602d3f21c84954541e7092bc55bb5ab

SHA256
2159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad

SHA512
70fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c

Download Submit
memory/1368-23-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-44-0x00000000771C6000-0x00000000771C7000-memory.dmp

Filesize
4KB

Download
memory/1368-11-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-10-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-9-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-8-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-7-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-25-0x0000000077460000-0x0000000077462000-memory.dmp

Filesize
8KB

Download
memory/1368-24-0x0000000077430000-0x0000000077432000-memory.dmp

Filesize
8KB

Download
memory/1368-3-0x00000000771C6000-0x00000000771C7000-memory.dmp

Filesize
4KB

Download
memory/1368-34-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-35-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-4-0x0000000002A30000-0x0000000002A31000-memory.dmp

Filesize
4KB

Download
memory/1368-12-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-13-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-14-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-6-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1368-22-0x0000000002A10000-0x0000000002A17000-memory.dmp

Filesize
28KB

Download
memory/1620-90-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/1840-43-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/1840-1-0x00000000000A0000-0x00000000000A7000-memory.dmp

Filesize
28KB

Download
memory/1840-0-0x0000000140000000-0x00000001400EA000-memory.dmp

Filesize
936KB

Download
memory/2620-57-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/2620-54-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2620-52-0x0000000140000000-0x00000001400EB000-memory.dmp

Filesize
940KB

Download
memory/2644-69-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download
memory/2644-71-0x0000000000080000-0x0000000000087000-memory.dmp

Filesize
28KB

Download
memory/2644-74-0x0000000140000000-0x00000001400EC000-memory.dmp

Filesize
944KB

Download