dridex | e290de84b0aa6e41b165970f2232c7f9df6793af3773e6713badd471aa7ab697

General

Target

e290de84b0aa6e41b165970f2232c7f9df6793af3773e6713badd471aa7ab697.dll
Size

1.4MB
MD5

761c54dc1cf33fe2056c26e668929d7a
SHA1

81394606e1b3ff225eff9172d0b2ca7004816c0d
SHA256

e290de84b0aa6e41b165970f2232c7f9df6793af3773e6713badd471aa7ab697
SHA512

d7500315bf5a414782736b5f41c9d095a56f4ab05c5e0e392a90d267149a6542fe44ac9755297dcca987ee52e22395faedba7a99a93526e0db86e7e14086fc65
SSDEEP

12288:jkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Caa:jkMZ+gf4ltGd8H1fYO0q2G1Ah9

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3360-4-0x0000000002370000-0x0000000002371000-memory.dmp	dridex_stager_shellcode

Dridex payload 8 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/2388-0-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral2/memory/3360-24-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral2/memory/3360-35-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral2/memory/2388-38-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral2/memory/3132-45-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/3132-50-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/1816-66-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral2/memory/3516-81-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

BdeUISrv.exeAgentService.exeSystemSettingsAdminFlows.exe

pid process

3132 BdeUISrv.exe
1816 AgentService.exe
3516 SystemSettingsAdminFlows.exe
Loads dropped DLL 3 IoCs

Processes:

BdeUISrv.exeAgentService.exeSystemSettingsAdminFlows.exe

pid process

3132 BdeUISrv.exe
1816 AgentService.exe
3516 SystemSettingsAdminFlows.exe

pid	process
3132	BdeUISrv.exe
1816	AgentService.exe
3516	SystemSettingsAdminFlows.exe

pid	process
3132	BdeUISrv.exe
1816	AgentService.exe
3516	SystemSettingsAdminFlows.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Sarxmtvezib = "C:\\Users\\Admin\\AppData\\Roaming\\Sun\\Java\\xmpqg\\AgentService.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeBdeUISrv.exeAgentService.exeSystemSettingsAdminFlows.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BdeUISrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AgentService.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemSettingsAdminFlows.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2388	rundll32.exe
2388	rundll32.exe
2388	rundll32.exe
2388	rundll32.exe
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360
3360

Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3360

pid	process
3360

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3360 wrote to memory of 32	3360	BdeUISrv.exe
PID 3360 wrote to memory of 32	3360	BdeUISrv.exe
PID 3360 wrote to memory of 3132	3360	BdeUISrv.exe
PID 3360 wrote to memory of 3132	3360	BdeUISrv.exe
PID 3360 wrote to memory of 2096	3360	AgentService.exe
PID 3360 wrote to memory of 2096	3360	AgentService.exe
PID 3360 wrote to memory of 1816	3360	AgentService.exe
PID 3360 wrote to memory of 1816	3360	AgentService.exe
PID 3360 wrote to memory of 3896	3360	SystemSettingsAdminFlows.exe
PID 3360 wrote to memory of 3896	3360	SystemSettingsAdminFlows.exe
PID 3360 wrote to memory of 3516	3360	SystemSettingsAdminFlows.exe
PID 3360 wrote to memory of 3516	3360	SystemSettingsAdminFlows.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e290de84b0aa6e41b165970f2232c7f9df6793af3773e6713badd471aa7ab697.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2388

C:\Windows\system32\BdeUISrv.exe
C:\Windows\system32\BdeUISrv.exe
1⤵
PID:32

C:\Users\Admin\AppData\Local\K12QS\BdeUISrv.exe
C:\Users\Admin\AppData\Local\K12QS\BdeUISrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3132

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
PID:2096

C:\Users\Admin\AppData\Local\WcBLcaJ2a\AgentService.exe
C:\Users\Admin\AppData\Local\WcBLcaJ2a\AgentService.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1816

C:\Windows\system32\SystemSettingsAdminFlows.exe
C:\Windows\system32\SystemSettingsAdminFlows.exe
1⤵
PID:3896

C:\Users\Admin\AppData\Local\TtpXP\SystemSettingsAdminFlows.exe
C:\Users\Admin\AppData\Local\TtpXP\SystemSettingsAdminFlows.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\K12QS\BdeUISrv.exe

Filesize
54KB

MD5
8595075667ff2c9a9f9e2eebc62d8f53

SHA1
c48b54e571f05d4e21d015bb3926c2129f19191a

SHA256
20b05c77f898be08737082e969b39f54fa39753c8c0a06142eb7ad5e0764a2db

SHA512
080dbcdd9234c07efe6cea4919ffa305fdc381ccebed9d1020dd6551b54e20e52387e62a344502fa4a85249defd0f9b506528b8dd34675bc9f51f664b8fc4d88

Download Submit
C:\Users\Admin\AppData\Local\K12QS\WTSAPI32.dll

Filesize
1.4MB

MD5
7ff9cc290f759c2a376253a9b8be49ea

SHA1
e7e747f0b0dc431d447be06dcefc5fd05680680b

SHA256
048cdb162976ec31cb9e7dc515586ab2d53413185b39375b3d47726f2cddb923

SHA512
23c45a50959d0ed54c043788b29dfc472bc80548c784c2f560b247734676b7780d5a52d18d818ce119d1f819ddfd396fdc9c94b2053dc02fe825633b9bb48f31

Download Submit
C:\Users\Admin\AppData\Local\TtpXP\SystemSettingsAdminFlows.exe

Filesize
506KB

MD5
50adb2c7c145c729b9de8b7cf967dd24

SHA1
a31757f08da6f95156777c1132b6d5f1db3d8f30

SHA256
a7a2e7122d27308df37b7ab718ef3ac239e4216669f51331e34e205f59fb0aec

SHA512
715b4c93e79e896da1cf86cf4455a84cba1aeac34b6fd72d2afdf203a2034f6f8fac1d6501f0dd277a17bd1d7ab73ddd1887e01a99f2d26f39efeb94d0aac9b0

Download Submit
C:\Users\Admin\AppData\Local\TtpXP\newdev.dll

Filesize
1.4MB

MD5
8a1954f84a1cd8004419ae141eb13d47

SHA1
34e36e5763a0c88d6c87775d8a6205a342a63afa

SHA256
fd299915b7f83c626a61f9bc34e80a6a10341e1d21c1f53dd67e56f34a9fd299

SHA512
8d9affd5c3abf3a4cb8ba491eb1c000498329b663734541330fb5b9a6c7df70812b9e253ab9e3d625db9ab726447f81a8f2ebeb6fb930c5c81a51b0cc5955dad

Download Submit
C:\Users\Admin\AppData\Local\WcBLcaJ2a\AgentService.exe

Filesize
1.2MB

MD5
f8bac206def3e87ceb8ef3cb0fb5a194

SHA1
a28ea816e7b5ca511da4576262a5887a75171276

SHA256
c69e4520d5dd84a409c2df1825ba30ec367400e4f7b001c8e971da8bef1a2268

SHA512
8df9a814c738e79492a3b72ba359bf3aedfb89fe02215ef58e743c541a2194ba47e227969d76c55387eee6eb367ca68e4b3cdf054022cb86e62376cc2fdef909

Download Submit
C:\Users\Admin\AppData\Local\WcBLcaJ2a\VERSION.dll

Filesize
1.4MB

MD5
c4a43ab6105dc02e4a8d59381e3633e0

SHA1
056b7ed5938cbdde56347e23cafbcb602fb07b74

SHA256
e5419d5cdafdfa5b0009a0e0dfdb1d8b127a098eea95e4daac1296383ab6ab7a

SHA512
3aaac9cd3d2823ab9d77445e376ee6c3ef5af554ba1e90e3dd109de43bab489037fff6bfb3a47eada46065abffd3e9aac02467417d6bd5a755e65d5249a5b9bb

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Rasxaa.lnk

Filesize
1KB

MD5
e9dff1e12cbc5f73026280902fae80f3

SHA1
da79e092a05a76a9455a4b9c8bc3211475aee5f6

SHA256
f07385152cfd2c483315176ab42165813c5b54fa7868ab3c21f5248c9e5a4107

SHA512
7b4fb85a1536ccd240236b1b7b94c70496c73010523ec1b95ae4f183150c9268b80f000c341cd1cdfafc52ff263b5aab10229ac62f39eb40620626494c1f0c15

Download Submit
memory/1816-66-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/1816-63-0x000002875D110000-0x000002875D117000-memory.dmp

Filesize
28KB

Download
memory/2388-2-0x0000024A1B950000-0x0000024A1B957000-memory.dmp

Filesize
28KB

Download
memory/2388-38-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/2388-0-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3132-50-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3132-45-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/3132-47-0x0000017947860000-0x0000017947867000-memory.dmp

Filesize
28KB

Download
memory/3360-24-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-35-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-8-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-7-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-10-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-11-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-12-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-13-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-25-0x00007FF961120000-0x00007FF961130000-memory.dmp

Filesize
64KB

Download
memory/3360-9-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-26-0x00007FF961110000-0x00007FF961120000-memory.dmp

Filesize
64KB

Download
memory/3360-15-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-23-0x0000000000150000-0x0000000000157000-memory.dmp

Filesize
28KB

Download
memory/3360-14-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-6-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3360-4-0x0000000002370000-0x0000000002371000-memory.dmp

Filesize
4KB

Download
memory/3360-3-0x00007FF96016A000-0x00007FF96016B000-memory.dmp

Filesize
4KB

Download
memory/3516-81-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads