dridex | 4045c8c25b01a13d4ddb043efc4b03c5cf9d59fd5a85eb8403576fabf992af7d

General

Target

4045c8c25b01a13d4ddb043efc4b03c5cf9d59fd5a85eb8403576fabf992af7d.dll
Size

1.2MB
MD5

a85440e55b4cbf0624dff9e908308693
SHA1

acd4bdee53cd2d77cfc312ec032c0cb5ff97dfbe
SHA256

4045c8c25b01a13d4ddb043efc4b03c5cf9d59fd5a85eb8403576fabf992af7d
SHA512

53a240857da2b0707d09a534ae69e26ea59ae831b21c195e99b312f550263df59f04c951bab053e954baeb90de50067ec8f662dc74df9455f8984feda365f21d
SSDEEP

12288:qqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baedh:qqGBHTxvt+g2gYed

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1212-4-0x0000000002B30000-0x0000000002B31000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1736-1-0x0000000140000000-0x0000000140127000-memory.dmp	dridex_payload
behavioral1/memory/1212-24-0x0000000140000000-0x0000000140127000-memory.dmp	dridex_payload
behavioral1/memory/1212-35-0x0000000140000000-0x0000000140127000-memory.dmp	dridex_payload
behavioral1/memory/1212-37-0x0000000140000000-0x0000000140127000-memory.dmp	dridex_payload
behavioral1/memory/1736-44-0x0000000140000000-0x0000000140127000-memory.dmp	dridex_payload
behavioral1/memory/2876-55-0x0000000140000000-0x0000000140128000-memory.dmp	dridex_payload
behavioral1/memory/2876-58-0x0000000140000000-0x0000000140128000-memory.dmp	dridex_payload
behavioral1/memory/1316-76-0x0000000140000000-0x0000000140128000-memory.dmp	dridex_payload
behavioral1/memory/2996-90-0x0000000140000000-0x0000000140129000-memory.dmp	dridex_payload
behavioral1/memory/2996-94-0x0000000140000000-0x0000000140129000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

rstrui.exewextract.exerrinstaller.exe

pid process

2876 rstrui.exe
1316 wextract.exe
2996 rrinstaller.exe
Loads dropped DLL 7 IoCs

Processes:

rstrui.exewextract.exerrinstaller.exe

pid process

1212
2876 rstrui.exe
1212
1316 wextract.exe
1212
2996 rrinstaller.exe
1212

pid	process
2876	rstrui.exe
1316	wextract.exe
2996	rrinstaller.exe

pid	process
1212
2876	rstrui.exe
1212
1316	wextract.exe
1212
2996	rrinstaller.exe
1212

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgvptlq = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\EZ1BCR~1\\wextract.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exerstrui.exewextract.exerrinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rstrui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wextract.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rrinstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1736	rundll32.exe
1736	rundll32.exe
1736	rundll32.exe
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1212 wrote to memory of 2944	1212	rstrui.exe
PID 1212 wrote to memory of 2944	1212	rstrui.exe
PID 1212 wrote to memory of 2944	1212	rstrui.exe
PID 1212 wrote to memory of 2876	1212	rstrui.exe
PID 1212 wrote to memory of 2876	1212	rstrui.exe
PID 1212 wrote to memory of 2876	1212	rstrui.exe
PID 1212 wrote to memory of 1944	1212	wextract.exe
PID 1212 wrote to memory of 1944	1212	wextract.exe
PID 1212 wrote to memory of 1944	1212	wextract.exe
PID 1212 wrote to memory of 1316	1212	wextract.exe
PID 1212 wrote to memory of 1316	1212	wextract.exe
PID 1212 wrote to memory of 1316	1212	wextract.exe
PID 1212 wrote to memory of 3056	1212	rrinstaller.exe
PID 1212 wrote to memory of 3056	1212	rrinstaller.exe
PID 1212 wrote to memory of 3056	1212	rrinstaller.exe
PID 1212 wrote to memory of 2996	1212	rrinstaller.exe
PID 1212 wrote to memory of 2996	1212	rrinstaller.exe
PID 1212 wrote to memory of 2996	1212	rrinstaller.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4045c8c25b01a13d4ddb043efc4b03c5cf9d59fd5a85eb8403576fabf992af7d.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1736

C:\Windows\system32\rstrui.exe
C:\Windows\system32\rstrui.exe
1⤵
PID:2944

C:\Users\Admin\AppData\Local\VWQ4QRIO\rstrui.exe
C:\Users\Admin\AppData\Local\VWQ4QRIO\rstrui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2876

C:\Windows\system32\wextract.exe
C:\Windows\system32\wextract.exe
1⤵
PID:1944

C:\Users\Admin\AppData\Local\cTTGKIGy\wextract.exe
C:\Users\Admin\AppData\Local\cTTGKIGy\wextract.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1316

C:\Windows\system32\rrinstaller.exe
C:\Windows\system32\rrinstaller.exe
1⤵
PID:3056

C:\Users\Admin\AppData\Local\4MHPuPBW\rrinstaller.exe
C:\Users\Admin\AppData\Local\4MHPuPBW\rrinstaller.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\4MHPuPBW\MFPlat.DLL

Filesize
1.2MB

MD5
a0a07cf112d04b24c2e00f3076018c19

SHA1
7e09b836e17900c457edb5b6b4e13134c7d36c83

SHA256
eba4e894e82835ee69e389b3f764631664cbad78c13daab54ce521fe91917863

SHA512
e6acdabd395bfcf598ba7daaeb2a012abaf87523aa28cb0aed43c50489016a07bb7c5b2c56b04c414fe15d96c56a5c5b29034a27bb5c1e6c59aea63458cbf431

Download Submit
C:\Users\Admin\AppData\Local\VWQ4QRIO\SPP.dll

Filesize
1.2MB

MD5
cf9131f1571b041efc6343b4ed878650

SHA1
39428e40123ac65f2da888900ec238e89ee85d32

SHA256
4f96e85476d26e9464e0bb3e51fb7739ebe0b693215cad60a82c4022efb2e73e

SHA512
22597fbbcd39e522f7398ad390063ca115242695767c8ffcb660903435552dcbb3395a70e1801be6304d15214ea52cb0887f0956e0b2853179abc3b66917b509

Download Submit
C:\Users\Admin\AppData\Local\cTTGKIGy\VERSION.dll

Filesize
1.2MB

MD5
6e1013d1c5bea0210efc221f6af8c417

SHA1
e99923611136228ca639e16c74c7c892b8a7cb16

SHA256
050e9376cff3865c76d2186ed5b7347f8db1f5a45cb851084f382baca7ccdc66

SHA512
3b7ffaf94dc3572daa7610e9e64e2d7f3c0050267a9f3d5974960a1a24b002bd793c021fbeb591ef9d75fc9ba3b3111ca880583cf54451dc7994dd3741157fcb

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

Filesize
1KB

MD5
e6b303b20d039c90a2f8d62a24c5eb6c

SHA1
d4389dbecea3b67c481e80ee419a559fc9052bc5

SHA256
238fcb581c4891710f33c35f9698ad733ffbdf4c11024991a3ea0c1f4e24b663

SHA512
434976fe3838db881f441a1803b18037c35eca5c88cf08e1df765f775f31f9b9965ebfd8cb5349853b9d9d38d6830f6e5a8113a3411abd59fc15ea356db77636

Download Submit
\Users\Admin\AppData\Local\4MHPuPBW\rrinstaller.exe

Filesize
54KB

MD5
0d3a73b0b30252680b383532f1758649

SHA1
9f098d2037e4dd94eca6d04c37b3d4ad8b0cc931

SHA256
fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc

SHA512
a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4

Download Submit
\Users\Admin\AppData\Local\VWQ4QRIO\rstrui.exe

Filesize
290KB

MD5
3db5a1eace7f3049ecc49fa64461e254

SHA1
7dc64e4f75741b93804cbae365e10dc70592c6a9

SHA256
ba8387d4543b8b11e2202919b9608ee614753fe77f967aad9906702841658b49

SHA512
ea81e3233e382f1cf2938785c9ded7c8fbbf11a6a6f5cf4323e3211ae66dad4a2c597cb589ff11f9eae79516043aba77d4b24bfa6eb0aa045d405aabdea4a025

Download Submit
\Users\Admin\AppData\Local\cTTGKIGy\wextract.exe

Filesize
140KB

MD5
1ea6500c25a80e8bdb65099c509af993

SHA1
6a090ef561feb4ae1c6794de5b19c5e893c4aafc

SHA256
99123d4e7bf93aa7f3315a432307c8b0cbaf24ad2cfb46edc149edbe24de4ca2

SHA512
b8f9f1ab48671e382d1385c34f0f19fc52fc0061e00db53bbbc2cdaee6d8a3f245707329f98e9167c53721aeaddcebfe66632729b6bcc98892031fd9914fb1fb

Download Submit
memory/1212-26-0x0000000077DC0000-0x0000000077DC2000-memory.dmp

Filesize
8KB

Download
memory/1212-3-0x0000000077A26000-0x0000000077A27000-memory.dmp

Filesize
4KB

Download
memory/1212-15-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-13-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-12-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-11-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-9-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-8-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-24-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-6-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-25-0x0000000077D90000-0x0000000077D92000-memory.dmp

Filesize
8KB

Download
memory/1212-35-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-37-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-16-0x0000000002B10000-0x0000000002B17000-memory.dmp

Filesize
28KB

Download
memory/1212-45-0x0000000077A26000-0x0000000077A27000-memory.dmp

Filesize
4KB

Download
memory/1212-14-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-7-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1212-4-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/1212-10-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1316-76-0x0000000140000000-0x0000000140128000-memory.dmp

Filesize
1.2MB

Download
memory/1736-44-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/1736-0-0x0000000000420000-0x0000000000427000-memory.dmp

Filesize
28KB

Download
memory/1736-1-0x0000000140000000-0x0000000140127000-memory.dmp

Filesize
1.2MB

Download
memory/2876-58-0x0000000140000000-0x0000000140128000-memory.dmp

Filesize
1.2MB

Download
memory/2876-55-0x0000000140000000-0x0000000140128000-memory.dmp

Filesize
1.2MB

Download
memory/2876-53-0x0000000001B40000-0x0000000001B47000-memory.dmp

Filesize
28KB

Download
memory/2996-90-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download
memory/2996-94-0x0000000140000000-0x0000000140129000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads