dridex | 4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

General

Target

4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll
Size

700KB
MD5

6bd456cfeba026cd573f86e5531ea384
SHA1

66a88b459322450c073b8c4626f9967e951775c5
SHA256

4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb
SHA512

a35d4de20a6d51f668e08509255b7ba6ae8085170118c23f65202eb22d7687ae1474a29227f57410e146ca3ab27397d86329acfb08c48806308665f561943f3a
SSDEEP

12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1124-4-0x0000000002DA0000-0x0000000002DA1000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2172-0-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1124-24-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1124-35-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1124-36-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2172-44-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2692-53-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2692-58-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2264-70-0x0000000140000000-0x00000001400B1000-memory.dmp	dridex_payload
behavioral1/memory/2264-75-0x0000000140000000-0x00000001400B1000-memory.dmp	dridex_payload
behavioral1/memory/2660-91-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

javaws.exePresentationSettings.exeslui.exe

pid process

2692 javaws.exe
2264 PresentationSettings.exe
2660 slui.exe
Loads dropped DLL 7 IoCs

Processes:

javaws.exePresentationSettings.exeslui.exe

pid process

1124
2692 javaws.exe
1124
2264 PresentationSettings.exe
1124
2660 slui.exe
1124

pid	process
2692	javaws.exe
2264	PresentationSettings.exe
2660	slui.exe

pid	process
1124
2692	javaws.exe
1124
2264	PresentationSettings.exe
1124
2660	slui.exe
1124

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mcbsdqtxprcnbm = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\OdSgNlw\\PresentationSettings.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exejavaws.exePresentationSettings.exeslui.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	javaws.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PresentationSettings.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2172	rundll32.exe
2172	rundll32.exe
2172	rundll32.exe
2172	rundll32.exe
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124
1124

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1124 wrote to memory of 2620	1124	javaws.exe
PID 1124 wrote to memory of 2620	1124	javaws.exe
PID 1124 wrote to memory of 2620	1124	javaws.exe
PID 1124 wrote to memory of 2692	1124	javaws.exe
PID 1124 wrote to memory of 2692	1124	javaws.exe
PID 1124 wrote to memory of 2692	1124	javaws.exe
PID 1124 wrote to memory of 2256	1124	PresentationSettings.exe
PID 1124 wrote to memory of 2256	1124	PresentationSettings.exe
PID 1124 wrote to memory of 2256	1124	PresentationSettings.exe
PID 1124 wrote to memory of 2264	1124	PresentationSettings.exe
PID 1124 wrote to memory of 2264	1124	PresentationSettings.exe
PID 1124 wrote to memory of 2264	1124	PresentationSettings.exe
PID 1124 wrote to memory of 772	1124	slui.exe
PID 1124 wrote to memory of 772	1124	slui.exe
PID 1124 wrote to memory of 772	1124	slui.exe
PID 1124 wrote to memory of 2660	1124	slui.exe
PID 1124 wrote to memory of 2660	1124	slui.exe
PID 1124 wrote to memory of 2660	1124	slui.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2172

C:\Windows\system32\javaws.exe
C:\Windows\system32\javaws.exe
1⤵
PID:2620

C:\Users\Admin\AppData\Local\iwLkpB\javaws.exe
C:\Users\Admin\AppData\Local\iwLkpB\javaws.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2692

C:\Windows\system32\PresentationSettings.exe
C:\Windows\system32\PresentationSettings.exe
1⤵
PID:2256

C:\Users\Admin\AppData\Local\GvqCd\PresentationSettings.exe
C:\Users\Admin\AppData\Local\GvqCd\PresentationSettings.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2264

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:772

C:\Users\Admin\AppData\Local\1Hui\slui.exe
C:\Users\Admin\AppData\Local\1Hui\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\1Hui\slc.dll

Filesize
704KB

MD5
8b3301a73ab7b0f1b9c488f98bc21e43

SHA1
99d8d86811627fc73315a4261850171e7519d78e

SHA256
298df16dc69a16553e8182cb5495d125914279854d0844050b3db2cb28fe8223

SHA512
5b8dfb4c7306dce90eacfa1ffd2c3e45d8c2923291214535a00045a875a5ed1236f670a53335c8ceaeb78ca28362c638001b0f1ba981d7fa17cf4e1620acf073

Download Submit
C:\Users\Admin\AppData\Local\GvqCd\WINMM.dll

Filesize
708KB

MD5
b2fc790026650e5f1e76d68dbb56e61f

SHA1
230c4a75e8d63673e4747f31e08e37fe52df2f82

SHA256
d23cc8f80ea2be69bd12f033db5c97816be5a638351ffb6fd957233ea86a79a1

SHA512
907a3cec7c7470b175e717936dbf9403a401dcb317c635b06ff0cdf2042da493256ec55036ec96a46476eea3a8182275abf59b8f2a9918ff0b42f147cd8f76ee

Download Submit
C:\Users\Admin\AppData\Local\iwLkpB\VERSION.dll

Filesize
704KB

MD5
856073129b1f618e9a7f8256faa1abd6

SHA1
7db44fefbf0b38713d0ba63f40b32e01912bb526

SHA256
405bc69a64f54746540cd93eb426d4d43eb7c389e2f45bb83dec9bed75b2a828

SHA512
aac59383d099fd8a38f42c01c03f7478d3830207560ad437c149a5c34b2d1b323decaf596f4ba6049961c5804da938e74f31b7b4d060312904bebdc6aaf78c9e

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ygxjfqh.lnk

Filesize
1KB

MD5
6ae027328db2cf51cc8d40f494e59c92

SHA1
91d76dcd5ea5b10b62c1ead5d56bb4437b97fd11

SHA256
deee94285503526fa4ad36d827ffdcf03475d46cdba4ea4a7d48b8d4eca4b406

SHA512
64f28786872a8022aedf89f383cfd94275c282a63da3a853049604cf4e7801d8f72eafc86ee68e0c67164cf609f0c482b258329edf2b5435566e52c9bcb88d10

Download Submit
\Users\Admin\AppData\Local\1Hui\slui.exe

Filesize
341KB

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
\Users\Admin\AppData\Local\GvqCd\PresentationSettings.exe

Filesize
172KB

MD5
a6f8d318f6041334889481b472000081

SHA1
b8cf08ec17b30c8811f2514246fcdff62731dd58

SHA256
208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258

SHA512
60f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69

Download Submit
\Users\Admin\AppData\Local\iwLkpB\javaws.exe

Filesize
312KB

MD5
f94bc1a70c942621c4279236df284e04

SHA1
8f46d89c7db415a7f48ccd638963028f63df4e4f

SHA256
be9f8986a6c86d9f77978105d48b59eebfec3b9732dbf19e0f3d48bf7f20120c

SHA512
60edf20ca3cae9802263446af266568d0b5e0692eddcfcfc3b2f9a39327b3184613ca994460b919d17a6edc5936b4da16d9033f5138bcfd9bc0f09d88c8dcd52

Download Submit
memory/1124-10-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-12-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-3-0x00000000779F6000-0x00000000779F7000-memory.dmp

Filesize
4KB

Download
memory/1124-9-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-8-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-13-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-24-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-7-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-6-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-26-0x0000000077C90000-0x0000000077C92000-memory.dmp

Filesize
8KB

Download
memory/1124-25-0x0000000077C60000-0x0000000077C62000-memory.dmp

Filesize
8KB

Download
memory/1124-35-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-36-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-4-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Filesize
4KB

Download
memory/1124-45-0x00000000779F6000-0x00000000779F7000-memory.dmp

Filesize
4KB

Download
memory/1124-11-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-14-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-15-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1124-23-0x00000000029F0000-0x00000000029F7000-memory.dmp

Filesize
28KB

Download
memory/2172-44-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2172-2-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/2172-0-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2264-72-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/2264-70-0x0000000140000000-0x00000001400B1000-memory.dmp

Filesize
708KB

Download
memory/2264-75-0x0000000140000000-0x00000001400B1000-memory.dmp

Filesize
708KB

Download
memory/2660-91-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2692-58-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2692-53-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2692-55-0x0000000001F90000-0x0000000001F97000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads