dridex | e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

General

Target

e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll
Size

1.3MB
MD5

c1149d0d1cd46a9b3eb35371b41c4a63
SHA1

9001ee8245fd45cfdf537afc41cdf6338fe66928
SHA256

e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8
SHA512

448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba
SSDEEP

12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1204-4-0x0000000002540000-0x0000000002541000-memory.dmp	dridex_stager_shellcode

Dridex payload 11 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2684-0-0x000007FEF5D20000-0x000007FEF5E6A000-memory.dmp	dridex_payload
behavioral1/memory/1204-21-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1204-29-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1204-42-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1204-41-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/2684-49-0x000007FEF5D20000-0x000007FEF5E6A000-memory.dmp	dridex_payload
behavioral1/memory/2604-60-0x000007FEF5D20000-0x000007FEF5E6B000-memory.dmp	dridex_payload
behavioral1/memory/2604-63-0x000007FEF5D20000-0x000007FEF5E6B000-memory.dmp	dridex_payload
behavioral1/memory/1560-76-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp	dridex_payload
behavioral1/memory/1560-80-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp	dridex_payload
behavioral1/memory/2920-96-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

mstsc.exeSystemPropertiesRemote.exeComputerDefaults.exe

pid process

2604 mstsc.exe
1560 SystemPropertiesRemote.exe
2920 ComputerDefaults.exe
Loads dropped DLL 7 IoCs

Processes:

mstsc.exeSystemPropertiesRemote.exeComputerDefaults.exe

pid process

1204
2604 mstsc.exe
1204
1560 SystemPropertiesRemote.exe
1204
2920 ComputerDefaults.exe
1204

pid	process
2604	mstsc.exe
1560	SystemPropertiesRemote.exe
2920	ComputerDefaults.exe

pid	process
1204
2604	mstsc.exe
1204
1560	SystemPropertiesRemote.exe
1204
2920	ComputerDefaults.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zoekctxdbskyzr = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\H9vd\\SYSTEM~1.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemstsc.exeSystemPropertiesRemote.exeComputerDefaults.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstsc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesRemote.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ComputerDefaults.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2684	rundll32.exe
2684	rundll32.exe
2684	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 2712	1204	mstsc.exe
PID 1204 wrote to memory of 2712	1204	mstsc.exe
PID 1204 wrote to memory of 2712	1204	mstsc.exe
PID 1204 wrote to memory of 2604	1204	mstsc.exe
PID 1204 wrote to memory of 2604	1204	mstsc.exe
PID 1204 wrote to memory of 2604	1204	mstsc.exe
PID 1204 wrote to memory of 1944	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 1944	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 1944	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 1560	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 1560	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 1560	1204	SystemPropertiesRemote.exe
PID 1204 wrote to memory of 636	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 636	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 636	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2920	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2920	1204	ComputerDefaults.exe
PID 1204 wrote to memory of 2920	1204	ComputerDefaults.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2684

C:\Windows\system32\mstsc.exe
C:\Windows\system32\mstsc.exe
1⤵
PID:2712

C:\Users\Admin\AppData\Local\hoyM\mstsc.exe
C:\Users\Admin\AppData\Local\hoyM\mstsc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2604

C:\Windows\system32\SystemPropertiesRemote.exe
C:\Windows\system32\SystemPropertiesRemote.exe
1⤵
PID:1944

C:\Users\Admin\AppData\Local\QdoWS\SystemPropertiesRemote.exe
C:\Users\Admin\AppData\Local\QdoWS\SystemPropertiesRemote.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1560

C:\Windows\system32\ComputerDefaults.exe
C:\Windows\system32\ComputerDefaults.exe
1⤵
PID:636

C:\Users\Admin\AppData\Local\Q8Z\ComputerDefaults.exe
C:\Users\Admin\AppData\Local\Q8Z\ComputerDefaults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Q8Z\appwiz.cpl

Filesize
1.3MB

MD5
99f794487c9663477ac8c1863cc9469d

SHA1
c4653b385bc271f61c0bde4346ac2fb063091c38

SHA256
b0e2b22cd18112cae83fa8065dd1aca5b7827eae870dca91295040c88f9d51fb

SHA512
7eee268da92d88c7724f2f033ed0553d76a194aabbf150f8f5ee972d90e81fb508014314b2caa1c218bfad318b559bac70d959ea2030d55a36ca40372469fc29

Download Submit
C:\Users\Admin\AppData\Local\QdoWS\SYSDM.CPL

Filesize
1.3MB

MD5
69967f6113d02f7a15dc97af85c7c42d

SHA1
aff440f2a5d2a0d133c92a7d24509e234f79d89b

SHA256
890a379ccd45ad924361d73be60b195d739a92dc289d77462780ffc210f0c50e

SHA512
4cd6b0360a76e0146f37f1ec419e11e2198a3d7b4b1fda760b252c2dab0a6be30c77aec385c047d4772e2f9bb2546c5603b8110f1b772ac15f4f5c67e7112071

Download Submit
C:\Users\Admin\AppData\Local\QdoWS\SystemPropertiesRemote.exe

Filesize
80KB

MD5
d0d7ac869aa4e179da2cc333f0440d71

SHA1
e7b9a58f5bfc1ec321f015641a60978c0c683894

SHA256
5762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a

SHA512
1808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7

Download Submit
C:\Users\Admin\AppData\Local\hoyM\credui.dll

Filesize
1.3MB

MD5
8625dc2c57625e79ef23aae6b4c47064

SHA1
66541a379b6d36dd5b7e90c9455a70c79762381f

SHA256
69d3a53ed039ec0a32c6244235cefa9b6e1ee563d2554323bb38639c61537c52

SHA512
751e3f15bc72677bf277083695f6ce91090fcfc6501dacb58fec434ca565749f23f8e9e9c94fddcb235ec2373068e194b01f412ab1439a8fc844ce3dc3111129

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Adlnwv.lnk

Filesize
772B

MD5
20bbc23247a0ad6724b2c42fb5dfd6e4

SHA1
b5764b621387475fcd4a765454e9237790c923d5

SHA256
8a30e3ba25ffd7e0d85fcac1047820e4bc2ae44703dbd6b4e63aa7e79bf37984

SHA512
328bca7c66ce3ef640945b8894702a212cd3fcf9e5130d9b5acd01fca8cebdcc341d8ff87d9f776941251d9ccc9345e43ffbefc80d971d1cc13f0430207114a2

Download Submit
\Users\Admin\AppData\Local\Q8Z\ComputerDefaults.exe

Filesize
36KB

MD5
86bd981f55341273753ac42ea200a81e

SHA1
14fe410efc9aeb0a905b984ac27719ff0dd10ea7

SHA256
40b194be2bad2d3d4d1b69f9aec2853c8b663130810a11607ff72a9e3a06d5b3

SHA512
49bb6d4bf7a9356fadde7f6165af6973630827d28b69db10ad477a84d98b08fb82e4daae777166e1ddddb5b5efcdf634e4e9bd34b255dae87462ba32e8bba143

Download Submit
\Users\Admin\AppData\Local\hoyM\mstsc.exe

Filesize
1.1MB

MD5
50f739538ef014b2e7ec59431749d838

SHA1
b439762b8efe8cfb977e7374c11a7e4d8ed05eb3

SHA256
85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3

SHA512
02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

Download Submit
memory/1204-16-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-41-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-11-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-17-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-21-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-13-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-14-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-28-0x0000000002520000-0x0000000002527000-memory.dmp

Filesize
28KB

Download
memory/1204-20-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-31-0x0000000077250000-0x0000000077252000-memory.dmp

Filesize
8KB

Download
memory/1204-30-0x0000000077220000-0x0000000077222000-memory.dmp

Filesize
8KB

Download
memory/1204-29-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-18-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-3-0x0000000076FB6000-0x0000000076FB7000-memory.dmp

Filesize
4KB

Download
memory/1204-15-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-19-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-42-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-12-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-6-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-4-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1204-50-0x0000000076FB6000-0x0000000076FB7000-memory.dmp

Filesize
4KB

Download
memory/1204-7-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-10-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-9-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1204-8-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1560-75-0x0000000000210000-0x0000000000217000-memory.dmp

Filesize
28KB

Download
memory/1560-76-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp

Filesize
1.3MB

Download
memory/1560-80-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp

Filesize
1.3MB

Download
memory/2604-63-0x000007FEF5D20000-0x000007FEF5E6B000-memory.dmp

Filesize
1.3MB

Download
memory/2604-60-0x000007FEF5D20000-0x000007FEF5E6B000-memory.dmp

Filesize
1.3MB

Download
memory/2604-58-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/2684-49-0x000007FEF5D20000-0x000007FEF5E6A000-memory.dmp

Filesize
1.3MB

Download
memory/2684-0-0x000007FEF5D20000-0x000007FEF5E6A000-memory.dmp

Filesize
1.3MB

Download
memory/2684-2-0x0000000001CF0000-0x0000000001CF7000-memory.dmp

Filesize
28KB

Download
memory/2920-96-0x000007FEF5BF0000-0x000007FEF5D3B000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads