dridex | 079c9b54059a2d71584c2abaf4295b20bfbd0510564ec0166404a0d6cd8aa5dd

General

Target

079c9b54059a2d71584c2abaf4295b20bfbd0510564ec0166404a0d6cd8aa5dd.dll
Size

1.1MB
MD5

b0c305619b4621dd6b6b10af932a4b2e
SHA1

f3ee38cace8615b6fba326e5261f048d24e7ff74
SHA256

079c9b54059a2d71584c2abaf4295b20bfbd0510564ec0166404a0d6cd8aa5dd
SHA512

af8719bf73dc454b8b64cb7b203b4dcb097aa3ea03376c592193bf4cf4ec36204fa59b95e400a369dbd4a9a833c4d64f4c2ffb6418b82e290c3736b3dcb9a0b5
SSDEEP

12288:ckMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:ckMZ+gf4ltGd8H1fYO0q2G1Ah

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/3560-3-0x0000000001640000-0x0000000001641000-memory.dmp	dridex_stager_shellcode

Dridex payload 9 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral2/memory/4996-1-0x0000000140000000-0x0000000140123000-memory.dmp	dridex_payload
behavioral2/memory/3560-24-0x0000000140000000-0x0000000140123000-memory.dmp	dridex_payload
behavioral2/memory/3560-36-0x0000000140000000-0x0000000140123000-memory.dmp	dridex_payload
behavioral2/memory/4996-38-0x0000000140000000-0x0000000140123000-memory.dmp	dridex_payload
behavioral2/memory/4832-46-0x0000000140000000-0x0000000140124000-memory.dmp	dridex_payload
behavioral2/memory/4832-50-0x0000000140000000-0x0000000140124000-memory.dmp	dridex_payload
behavioral2/memory/3012-61-0x0000000140000000-0x0000000140169000-memory.dmp	dridex_payload
behavioral2/memory/3012-66-0x0000000140000000-0x0000000140169000-memory.dmp	dridex_payload
behavioral2/memory/1972-81-0x0000000140000000-0x0000000140124000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

BitLockerWizardElev.exeWindowsActionDialog.exeusocoreworker.exe

pid process

4832 BitLockerWizardElev.exe
3012 WindowsActionDialog.exe
1972 usocoreworker.exe
Loads dropped DLL 3 IoCs

Processes:

BitLockerWizardElev.exeWindowsActionDialog.exeusocoreworker.exe

pid process

4832 BitLockerWizardElev.exe
3012 WindowsActionDialog.exe
1972 usocoreworker.exe

pid	process
4832	BitLockerWizardElev.exe
3012	WindowsActionDialog.exe
1972	usocoreworker.exe

pid	process
4832	BitLockerWizardElev.exe
3012	WindowsActionDialog.exe
1972	usocoreworker.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Labelis = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\Ke\\WindowsActionDialog.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

usocoreworker.exerundll32.exeBitLockerWizardElev.exeWindowsActionDialog.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	usocoreworker.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BitLockerWizardElev.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsActionDialog.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
4996	rundll32.exe
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560
3560

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

description	pid	target process
PID 3560 wrote to memory of 5108	3560	BitLockerWizardElev.exe
PID 3560 wrote to memory of 5108	3560	BitLockerWizardElev.exe
PID 3560 wrote to memory of 4832	3560	BitLockerWizardElev.exe
PID 3560 wrote to memory of 4832	3560	BitLockerWizardElev.exe
PID 3560 wrote to memory of 1984	3560	WindowsActionDialog.exe
PID 3560 wrote to memory of 1984	3560	WindowsActionDialog.exe
PID 3560 wrote to memory of 3012	3560	WindowsActionDialog.exe
PID 3560 wrote to memory of 3012	3560	WindowsActionDialog.exe
PID 3560 wrote to memory of 2864	3560	usocoreworker.exe
PID 3560 wrote to memory of 2864	3560	usocoreworker.exe
PID 3560 wrote to memory of 1972	3560	usocoreworker.exe
PID 3560 wrote to memory of 1972	3560	usocoreworker.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\079c9b54059a2d71584c2abaf4295b20bfbd0510564ec0166404a0d6cd8aa5dd.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:4996

C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\BitLockerWizardElev.exe
1⤵
PID:5108

C:\Users\Admin\AppData\Local\V1X474x\BitLockerWizardElev.exe
C:\Users\Admin\AppData\Local\V1X474x\BitLockerWizardElev.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:4832

C:\Windows\system32\WindowsActionDialog.exe
C:\Windows\system32\WindowsActionDialog.exe
1⤵
PID:1984

C:\Users\Admin\AppData\Local\WpB56\WindowsActionDialog.exe
C:\Users\Admin\AppData\Local\WpB56\WindowsActionDialog.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3012

C:\Windows\system32\usocoreworker.exe
C:\Windows\system32\usocoreworker.exe
1⤵
PID:2864

C:\Users\Admin\AppData\Local\8MLM6w7sX\usocoreworker.exe
C:\Users\Admin\AppData\Local\8MLM6w7sX\usocoreworker.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\8MLM6w7sX\XmlLite.dll

Filesize
1.1MB

MD5
62cc8461938ab9359e6f6b50b850e88d

SHA1
949a96e58a5256850765846f454086a177bf27bb

SHA256
e82a9b63010f5d8c9343e764b923972b04199bf4f4bc3b3bf8648fb715fedf11

SHA512
b12694b083df7591ffb00696e09a226c3ed624b90523f4a7c850e9383110391dcc9a210211b7ec03856573fb8d14b5666ba2999e988d5fedb66259a083fefd4d

Download Submit
C:\Users\Admin\AppData\Local\8MLM6w7sX\usocoreworker.exe

Filesize
1.3MB

MD5
2c5efb321aa64af37dedc6383ce3198e

SHA1
a06d7020dd43a57047a62bfb443091cd9de946ba

SHA256
0fb6688a32340036f3eaab4a09a82dee533bfb2ca266c36f6142083134de6f0e

SHA512
5448ea01b24af7444505bda80064849a2efcc459011d32879e021e836fd573c9b1b9d3b37291d3f53ff536c691ac13a545b12f318a16c8a367421986bbf002ed

Download Submit
C:\Users\Admin\AppData\Local\V1X474x\BitLockerWizardElev.exe

Filesize
100KB

MD5
8ac5a3a20cf18ae2308c64fd707eeb81

SHA1
31f2f0bdc2eb3e0d2a6cd626ea8ed71262865544

SHA256
803eb37617d450704766cb167dc9766e82102a94940a26a988ad26ab8be3f2f5

SHA512
85d0e28e4bffec709f26b2f0d20eb76373134af43bcaa70b97a03efa273b77dd4fbd4f6ee026774ce4029ab5a983aea057111efcd234ab1686a9bd0f7202748b

Download Submit
C:\Users\Admin\AppData\Local\V1X474x\FVEWIZ.dll

Filesize
1.1MB

MD5
bb41293390a0d3471085df683a0a5976

SHA1
99c8d05551c062d526d38af98be6d58af5a677ed

SHA256
af999c126367e17869e28357574b5db57586b6ea67d7187df4de1945b5222ed7

SHA512
208fce506a36051f27e4b3d347aa37a76c1c547e14d7443a44e960fcda33ed2b43dc89ed6b5c34b49cb8eb2314484a6648ea7f5fd3a8269ed48215cfbb941ee0

Download Submit
C:\Users\Admin\AppData\Local\WpB56\DUI70.dll

Filesize
1.4MB

MD5
0beb9312a6fd023a3e978750a80616b9

SHA1
425460cabe2d27179ae82b7c989a8d6c91abacd0

SHA256
cf65820b7dc7a4647a11fa8959d8f778208f73c8a17137c4deb6649f9238cdf2

SHA512
de8d4f23314f150c3e1fc8fad9eaba080c9be5251a228daec7db3ba5b12c03f8f6ed4e0b473e50c65887b11cb5e9e458310c099021915c2798646153bc825e77

Download Submit
C:\Users\Admin\AppData\Local\WpB56\WindowsActionDialog.exe

Filesize
61KB

MD5
73c523b6556f2dc7eefc662338d66f8d

SHA1
1e6f9a1d885efa4d76f1e7a8be2e974f2b65cea5

SHA256
0c6397bfbcd7b1fcefb6de01a506578e36651725a61078c69708f1f92c41ea31

SHA512
69d0f23d1abaad657dd4672532936ef35f0e9d443caf9e19898017656a66ed46e75e7e05261c7e7636799c58feccd01dc93975d6a598cbb73242ddb48c6ec912

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ltmfycbfnis.lnk

Filesize
1KB

MD5
fc0fbbe9e30a3652690d342be4414ac8

SHA1
6a969cfc07821a3e9d09a7fa5ec346363c8c4773

SHA256
787ef9cfc40ed4c78c820e16e900355d1ac1bfdf7c03ca690478f918a8ec9b87

SHA512
ef34f87e1d48785b0e46d46515f5cf17caf5b098cd7b19d8f8915e1348672e187fcc6c158e29bcf1bca952807288eecb2f9c3008451c23736a331f60c0babe5e

Download Submit
memory/1972-81-0x0000000140000000-0x0000000140124000-memory.dmp

Filesize
1.1MB

Download
memory/3012-66-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3012-63-0x000001BCC1290000-0x000001BCC1297000-memory.dmp

Filesize
28KB

Download
memory/3012-61-0x0000000140000000-0x0000000140169000-memory.dmp

Filesize
1.4MB

Download
memory/3560-26-0x00007FFECEBB0000-0x00007FFECEBC0000-memory.dmp

Filesize
64KB

Download
memory/3560-12-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-7-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-6-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-24-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-5-0x00007FFECDD2A000-0x00007FFECDD2B000-memory.dmp

Filesize
4KB

Download
memory/3560-25-0x00007FFECEBC0000-0x00007FFECEBD0000-memory.dmp

Filesize
64KB

Download
memory/3560-36-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-3-0x0000000001640000-0x0000000001641000-memory.dmp

Filesize
4KB

Download
memory/3560-8-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-9-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-14-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-15-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-23-0x0000000001400000-0x0000000001407000-memory.dmp

Filesize
28KB

Download
memory/3560-10-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-11-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/3560-13-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/4832-50-0x0000000140000000-0x0000000140124000-memory.dmp

Filesize
1.1MB

Download
memory/4832-46-0x0000000140000000-0x0000000140124000-memory.dmp

Filesize
1.1MB

Download
memory/4832-45-0x0000021F1D570000-0x0000021F1D577000-memory.dmp

Filesize
28KB

Download
memory/4996-38-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download
memory/4996-0-0x0000019AD5470000-0x0000019AD5477000-memory.dmp

Filesize
28KB

Download
memory/4996-1-0x0000000140000000-0x0000000140123000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads