dridex | 82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b

General

Target

82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll
Size

1.4MB
MD5

6ad98a87dfac01169872c8d4fcfcf27d
SHA1

e5c6476f15f2d64c0626335585f0f18ed917248a
SHA256

82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b
SHA512

1fef8d13244cf1a724bdac23697f48ba5bfd3af84666d713ada3684d6fc7c1b0dd0ce05fdefc898298e5b1b8986160d85787ed0e728d72293344174696b0257b
SSDEEP

12288:+kMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64Cu5:+kMZ+gf4ltGd8H1fYO0q2G1Ahu5

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1212-4-0x0000000002D00000-0x0000000002D01000-memory.dmp	dridex_stager_shellcode

Dridex payload 9 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1060-1-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral1/memory/1212-24-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral1/memory/1212-35-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral1/memory/1212-36-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral1/memory/1060-44-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral1/memory/2960-54-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral1/memory/2960-58-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral1/memory/3056-75-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload
behavioral1/memory/1712-91-0x0000000140000000-0x0000000140163000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

rdpinit.exeslui.execttune.exe

pid process

2960 rdpinit.exe
3056 slui.exe
1712 cttune.exe
Loads dropped DLL 7 IoCs

Processes:

rdpinit.exeslui.execttune.exe

pid process

1212
2960 rdpinit.exe
1212
3056 slui.exe
1212
1712 cttune.exe
1212

pid	process
2960	rdpinit.exe
3056	slui.exe
1712	cttune.exe

pid	process
1212
2960	rdpinit.exe
1212
3056	slui.exe
1212
1712	cttune.exe
1212

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rcoehfpd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\zvY7mJ4njFj\\slui.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

slui.execttune.exerundll32.exerdpinit.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cttune.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpinit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1060	rundll32.exe
1060	rundll32.exe
1060	rundll32.exe
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1212 wrote to memory of 2872	1212	rdpinit.exe
PID 1212 wrote to memory of 2872	1212	rdpinit.exe
PID 1212 wrote to memory of 2872	1212	rdpinit.exe
PID 1212 wrote to memory of 2960	1212	rdpinit.exe
PID 1212 wrote to memory of 2960	1212	rdpinit.exe
PID 1212 wrote to memory of 2960	1212	rdpinit.exe
PID 1212 wrote to memory of 2688	1212	slui.exe
PID 1212 wrote to memory of 2688	1212	slui.exe
PID 1212 wrote to memory of 2688	1212	slui.exe
PID 1212 wrote to memory of 3056	1212	slui.exe
PID 1212 wrote to memory of 3056	1212	slui.exe
PID 1212 wrote to memory of 3056	1212	slui.exe
PID 1212 wrote to memory of 1480	1212	cttune.exe
PID 1212 wrote to memory of 1480	1212	cttune.exe
PID 1212 wrote to memory of 1480	1212	cttune.exe
PID 1212 wrote to memory of 1712	1212	cttune.exe
PID 1212 wrote to memory of 1712	1212	cttune.exe
PID 1212 wrote to memory of 1712	1212	cttune.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\82095408cb1b096fdf360cc0ed6d8e2ba0232e62e4f37a01aa31b4fc69fc618b.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1060

C:\Windows\system32\rdpinit.exe
C:\Windows\system32\rdpinit.exe
1⤵
PID:2872

C:\Users\Admin\AppData\Local\nvt4S\rdpinit.exe
C:\Users\Admin\AppData\Local\nvt4S\rdpinit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2960

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:2688

C:\Users\Admin\AppData\Local\2TlEi\slui.exe
C:\Users\Admin\AppData\Local\2TlEi\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3056

C:\Windows\system32\cttune.exe
C:\Windows\system32\cttune.exe
1⤵
PID:1480

C:\Users\Admin\AppData\Local\13PIGUXQ\cttune.exe
C:\Users\Admin\AppData\Local\13PIGUXQ\cttune.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\13PIGUXQ\UxTheme.dll

Filesize
1.4MB

MD5
6a69ad9083d778c88fd7ecc492d37f1d

SHA1
588214dbf1989727586ec98739cf470356ddbdb6

SHA256
2481ce44c463f0f3423bffeec5b8b6e8ac172ba3b5046766856733d8ea8625d1

SHA512
cfa22fc902588203f2623b38ef468e1e4806f7764eac77761f6a21faa1f4c409e3bff6b04445bdd4f06aa93fa4469516caf6bea3fc72f9a30504f1a5c3df0835

Download Submit
C:\Users\Admin\AppData\Local\2TlEi\WINBRAND.dll

Filesize
1.4MB

MD5
e756ac114ad29b380a7be7517cfc23f5

SHA1
608d2b3eab3d33d20b22882652467a611b0a05bb

SHA256
c4d8b93699640f223ba5e5472f1ce431b89d974f964b4bb05d490d0ec9590b9b

SHA512
e0d9a6da216af21150d9af69d833a116603e5411b60ea0873a0b28e2afd2ff8980bb56a9baba89f66ccefee684bf80f9ee976c925678b2a63df8765fb71f671c

Download Submit
C:\Users\Admin\AppData\Local\nvt4S\WTSAPI32.dll

Filesize
1.4MB

MD5
ccb3d608eae5db928c3dce20d1c97ab8

SHA1
591bfe3aa2515b2967bd7d26f7b87f7391b1d78e

SHA256
40841c6eff58cddf6be1423d05bdaf53d0c9883ddaff561246722a15045db8db

SHA512
b20fadd3b92efa475ec9dc76ac5869943387e5e19e8365764cd41f4bcf49b7aa67f591c1a82dec6f84bcd0f49507a97af311571a02481a87286f64fc84daf130

Download Submit
C:\Users\Admin\AppData\Local\nvt4S\rdpinit.exe

Filesize
174KB

MD5
664e12e0ea009cc98c2b578ff4983c62

SHA1
27b302c0108851ac6cc37e56590dd9074b09c3c9

SHA256
00bd9c3c941a5a9b4fc8594d7b985f5f1ac48f0ba7495a728b8fa42b4b48a332

SHA512
f5eee4e924dcc3cf5e82eff36543e9d0e9c17dc2272b403cf30f8d2da42312821f5566249a98a952f5441b1f0d6d61a86b5c5198bc598d65ea9d4fb35822505d

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

Filesize
904B

MD5
464e8c8dde0ec1566556117248fe2e8f

SHA1
2bf0807f9b74b06e6ac1ce70581e9aaa8b52775f

SHA256
ad5f02dc259ab21d0711701d29af99db6f5c39ecb739217c610fc6d7d90e839a

SHA512
b7b66fab75cc0d685847fa7fd6425db81583c69fe18532f072027d1796e64e49ae586b649f70b32ddf4f382215c1e5dd3880f926374ef425f8f09a4799b20075

Download Submit
\Users\Admin\AppData\Local\13PIGUXQ\cttune.exe

Filesize
314KB

MD5
7116848fd23e6195fcbbccdf83ce9af4

SHA1
35fb16a0b68f8a84d5dfac8c110ef5972f1bee93

SHA256
39937665f72725bdb3b82389a5dbd906c63f4c14208312d7f7a59d6067e1cfa6

SHA512
e38bf57eee5836b8598dd88dc3d266f497d911419a8426f73df6dcaa503611a965aabbd746181cb19bc38eebdb48db778a17f781a8f9e706cbd7a6ebec38f894

Download Submit
\Users\Admin\AppData\Local\2TlEi\slui.exe

Filesize
341KB

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
memory/1060-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1060-1-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1060-44-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-26-0x0000000077CE0000-0x0000000077CE2000-memory.dmp

Filesize
8KB

Download
memory/1212-9-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-23-0x0000000002CE0000-0x0000000002CE7000-memory.dmp

Filesize
28KB

Download
memory/1212-14-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-13-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-25-0x0000000077CB0000-0x0000000077CB2000-memory.dmp

Filesize
8KB

Download
memory/1212-6-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-24-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-35-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-36-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-7-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-45-0x0000000077946000-0x0000000077947000-memory.dmp

Filesize
4KB

Download
memory/1212-8-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-15-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-3-0x0000000077946000-0x0000000077947000-memory.dmp

Filesize
4KB

Download
memory/1212-4-0x0000000002D00000-0x0000000002D01000-memory.dmp

Filesize
4KB

Download
memory/1212-12-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-10-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1212-11-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/1712-91-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/2960-58-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/2960-54-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download
memory/2960-53-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/3056-70-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/3056-75-0x0000000140000000-0x0000000140163000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads