dridex | e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-10-2024 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll
Size

1.3MB
MD5

c1149d0d1cd46a9b3eb35371b41c4a63
SHA1

9001ee8245fd45cfdf537afc41cdf6338fe66928
SHA256

e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8
SHA512

448fb9b0e378ce4c33fc691343e6b0e1aba4f12b17f0e960d3a575ec9ac3a9d59e9972072d222c3f615433fb58cadfad85f7433a6abf43042fd53e36f18f6dba
SSDEEP

12288:BXBQ3fMQyWV0rbDxyBWZh2TvtgHoiemIKI1ydX7wmqzq3wkgJ:9B/Qn0rbD8UZUDtgIiemI51Mwtewkm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1280-4-0x0000000002640000-0x0000000002641000-memory.dmp	dridex_stager_shellcode

Dridex payload 12 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral1/memory/1680-1-0x000007FEF7030000-0x000007FEF717A000-memory.dmp	dridex_payload
behavioral1/memory/1280-29-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1280-21-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1680-38-0x000007FEF7030000-0x000007FEF717A000-memory.dmp	dridex_payload
behavioral1/memory/1280-42-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/1280-41-0x0000000140000000-0x000000014014A000-memory.dmp	dridex_payload
behavioral1/memory/784-60-0x000007FEF6450000-0x000007FEF659B000-memory.dmp	dridex_payload
behavioral1/memory/784-63-0x000007FEF6450000-0x000007FEF659B000-memory.dmp	dridex_payload
behavioral1/memory/2844-76-0x000007FEF6480000-0x000007FEF65FE000-memory.dmp	dridex_payload
behavioral1/memory/2844-80-0x000007FEF6480000-0x000007FEF65FE000-memory.dmp	dridex_payload
behavioral1/memory/3036-102-0x000007FEF64B0000-0x000007FEF65FB000-memory.dmp	dridex_payload
behavioral1/memory/3036-106-0x000007FEF64B0000-0x000007FEF65FB000-memory.dmp	dridex_payload

Executes dropped EXE 4 IoCs

pid	Process
784	msdtc.exe
2844	dpapimig.exe
2964	wermgr.exe
3036	Netplwiz.exe

Loads dropped DLL 8 IoCs

pid	Process
1280	Process not Found
784	msdtc.exe
1280	Process not Found
2844	dpapimig.exe
1280	Process not Found
1280	Process not Found
3036	Netplwiz.exe
1280	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgvptlq = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\Recent\\VGFI2gp\\dpapimig.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msdtc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dpapimig.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Netplwiz.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1680	rundll32.exe
1680	rundll32.exe
1680	rundll32.exe
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found
1280	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2704	1280	Process not Found	30
PID 1280 wrote to memory of 2704	1280	Process not Found	30
PID 1280 wrote to memory of 2704	1280	Process not Found	30
PID 1280 wrote to memory of 784	1280	Process not Found	31
PID 1280 wrote to memory of 784	1280	Process not Found	31
PID 1280 wrote to memory of 784	1280	Process not Found	31
PID 1280 wrote to memory of 2232	1280	Process not Found	32
PID 1280 wrote to memory of 2232	1280	Process not Found	32
PID 1280 wrote to memory of 2232	1280	Process not Found	32
PID 1280 wrote to memory of 2844	1280	Process not Found	33
PID 1280 wrote to memory of 2844	1280	Process not Found	33
PID 1280 wrote to memory of 2844	1280	Process not Found	33
PID 1280 wrote to memory of 2976	1280	Process not Found	34
PID 1280 wrote to memory of 2976	1280	Process not Found	34
PID 1280 wrote to memory of 2976	1280	Process not Found	34
PID 1280 wrote to memory of 2964	1280	Process not Found	35
PID 1280 wrote to memory of 2964	1280	Process not Found	35
PID 1280 wrote to memory of 2964	1280	Process not Found	35
PID 1280 wrote to memory of 2860	1280	Process not Found	36
PID 1280 wrote to memory of 2860	1280	Process not Found	36
PID 1280 wrote to memory of 2860	1280	Process not Found	36
PID 1280 wrote to memory of 3036	1280	Process not Found	37
PID 1280 wrote to memory of 3036	1280	Process not Found	37
PID 1280 wrote to memory of 3036	1280	Process not Found	37

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e661ee88d2b42533974dbaf54bd50d687c83bc35e2110e3aac9dbf40358d5cf8.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1680

C:\Windows\system32\msdtc.exe
C:\Windows\system32\msdtc.exe
1⤵
PID:2704

C:\Users\Admin\AppData\Local\AcNbhN1Xm\msdtc.exe
C:\Users\Admin\AppData\Local\AcNbhN1Xm\msdtc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:784

C:\Windows\system32\dpapimig.exe
C:\Windows\system32\dpapimig.exe
1⤵
PID:2232

C:\Users\Admin\AppData\Local\MuZpZ9\dpapimig.exe
C:\Users\Admin\AppData\Local\MuZpZ9\dpapimig.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2844

C:\Windows\system32\wermgr.exe
C:\Windows\system32\wermgr.exe
1⤵
PID:2976

C:\Users\Admin\AppData\Local\i8op\wermgr.exe
C:\Users\Admin\AppData\Local\i8op\wermgr.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Windows\system32\Netplwiz.exe
C:\Windows\system32\Netplwiz.exe
1⤵
PID:2860

C:\Users\Admin\AppData\Local\VFH\Netplwiz.exe
C:\Users\Admin\AppData\Local\VFH\Netplwiz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\AcNbhN1Xm\VERSION.dll

Filesize
1.3MB

MD5
50772ed24fbb424d7f284368b37eda1b

SHA1
0cea8a3e11461eb901a8850c751fff5bd2ba8f95

SHA256
a2d961fee53559e81049af5e0f853b2f421b182ca9be02e327d8c2e65679b469

SHA512
d04d924f6fd6e5490566de4a42e93633d6569c7f4ccac06b6492d7e567a2cbec1649e04a3bbfad3599ca31a48a508f7876137c583b0ebee42ab507a314e0107d

Download Submit
C:\Users\Admin\AppData\Local\MuZpZ9\DUI70.dll

Filesize
1.5MB

MD5
72521d53de11615dc79feb126b59f1a7

SHA1
8df2221ba1b8aeeb1bef4591e312511bad350fdf

SHA256
273bf1d0018d665ac5f707cf01348af1815eff7f9e208d13d95f45236f8c98cf

SHA512
fd410b4dc2741648f72c6b04f1686287c161d8a5583b3eafbbb7172cc3835aba5ad46cfa979bfc2260124b79e7c272c0b31a175591d39ad2603823ed6e2d9ed6

Download Submit
C:\Users\Admin\AppData\Local\VFH\NETPLWIZ.dll

Filesize
1.3MB

MD5
0549c5477f160e6bfdf3a2311d2e563e

SHA1
ad89ce8591b9b1f0d3cf8a3dc67010c082ac50dc

SHA256
e92dbf2f935d58806d4955ba367787b7d389cf88c48dfb29a0d852318addb8dd

SHA512
27eef399f6d357f5ee3ec0a48e2143ae29f448a5145270d20e4a548eb846ec90934764efddbd999d8b40736e6e06c6a5ef55ac5b17bc5ac9a228d16fd8520b08

Download Submit
C:\Users\Admin\AppData\Local\i8op\wermgr.exe

Filesize
49KB

MD5
41df7355a5a907e2c1d7804ec028965d

SHA1
453263d230c6317eb4a2eb3aceeec1bbcf5e153d

SHA256
207bfec939e7c017c4704ba76172ee2c954f485ba593bc1bc8c7666e78251861

SHA512
59c9d69d3942543af4f387137226516adec1a4304bd5696c6c1d338f9e5f40d136450907351cce018563df1358e06a792005167f5c08c689df32d809c4cebdcf

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

Filesize
1KB

MD5
6adbaf02f75a88e88c0a61e4f93af81e

SHA1
58790a5ee5cc550f1732c41cefd6289a22a04e56

SHA256
43b3f0533e0a29fc42ba7688406896bf8e46fa2390e6dcabe067f42ca02f5653

SHA512
0676a78bc934254b0a9ac7d732a90858dfc8695cfbd2dcda8e1c50923ac505219f12b472bb0d7a12cba2ab52767b7be6d2a6871b947c02f99dbd2024ff7b2ce3

Download Submit
\Users\Admin\AppData\Local\AcNbhN1Xm\msdtc.exe

Filesize
138KB

MD5
de0ece52236cfa3ed2dbfc03f28253a8

SHA1
84bbd2495c1809fcd19b535d41114e4fb101466c

SHA256
2fbbec4cacb5161f68d7c2935852a5888945ca0f107cf8a1c01f4528ce407de3

SHA512
69386134667626c60c99d941c8ab52f8e5235e3897b5af76965572287afd5dcd42b8207a520587844a57a268e4decb3f3c550e5b7a06230ee677dc5e40c50bb3

Download Submit
\Users\Admin\AppData\Local\MuZpZ9\dpapimig.exe

Filesize
73KB

MD5
0e8b8abea4e23ddc9a70614f3f651303

SHA1
6d332ba4e7a78039f75b211845514ab35ab467b2

SHA256
66fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1

SHA512
4feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc

Download Submit
\Users\Admin\AppData\Local\VFH\Netplwiz.exe

Filesize
26KB

MD5
e43ec3c800d4c0716613392e81fba1d9

SHA1
37de6a235e978ecf3bb0fc2c864016c5b0134348

SHA256
636606415a85a16a7e6c5c8fcbdf35494991bce1c37dfc19c75ecb7ce12dc65c

SHA512
176c6d8b87bc5a9ca06698e2542ff34d474bcbbf21278390127981366eda89769bd9dd712f3b34f4dd8332a0b40ee0e609276400f16b51999471c8ff24522a08

Download Submit
memory/784-63-0x000007FEF6450000-0x000007FEF659B000-memory.dmp

Filesize
1.3MB

Download
memory/784-60-0x000007FEF6450000-0x000007FEF659B000-memory.dmp

Filesize
1.3MB

Download
memory/784-58-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download
memory/1280-15-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-3-0x0000000076CA6000-0x0000000076CA7000-memory.dmp

Filesize
4KB

Download
memory/1280-13-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-12-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-11-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-10-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-9-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-8-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-7-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-19-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-18-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-31-0x0000000076F40000-0x0000000076F42000-memory.dmp

Filesize
8KB

Download
memory/1280-30-0x0000000076F10000-0x0000000076F12000-memory.dmp

Filesize
8KB

Download
memory/1280-6-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-42-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-41-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-50-0x0000000076CA6000-0x0000000076CA7000-memory.dmp

Filesize
4KB

Download
memory/1280-14-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-16-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-20-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-21-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-29-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-28-0x0000000002220000-0x0000000002227000-memory.dmp

Filesize
28KB

Download
memory/1280-17-0x0000000140000000-0x000000014014A000-memory.dmp

Filesize
1.3MB

Download
memory/1280-4-0x0000000002640000-0x0000000002641000-memory.dmp

Filesize
4KB

Download
memory/1680-1-0x000007FEF7030000-0x000007FEF717A000-memory.dmp

Filesize
1.3MB

Download
memory/1680-38-0x000007FEF7030000-0x000007FEF717A000-memory.dmp

Filesize
1.3MB

Download
memory/1680-0-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2844-80-0x000007FEF6480000-0x000007FEF65FE000-memory.dmp

Filesize
1.5MB

Download
memory/2844-75-0x0000000000310000-0x0000000000317000-memory.dmp

Filesize
28KB

Download
memory/2844-76-0x000007FEF6480000-0x000007FEF65FE000-memory.dmp

Filesize
1.5MB

Download
memory/3036-102-0x000007FEF64B0000-0x000007FEF65FB000-memory.dmp

Filesize
1.3MB

Download
memory/3036-106-0x000007FEF64B0000-0x000007FEF65FB000-memory.dmp

Filesize
1.3MB

Download