dridex | 4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb

Analysis

max time kernel
150s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
14-10-2024 17:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll
Size

700KB
MD5

6bd456cfeba026cd573f86e5531ea384
SHA1

66a88b459322450c073b8c4626f9967e951775c5
SHA256

4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb
SHA512

a35d4de20a6d51f668e08509255b7ba6ae8085170118c23f65202eb22d7687ae1474a29227f57410e146ca3ab27397d86329acfb08c48806308665f561943f3a
SSDEEP

12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1248-4-0x0000000002D10000-0x0000000002D11000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1464-0-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1248-24-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1248-36-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1248-35-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1464-44-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2820-54-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2820-58-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2236-71-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/2236-75-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/2288-90-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

psr.exeeudcedit.exewisptis.exe

pid	Process
2820	psr.exe
2236	eudcedit.exe
2288	wisptis.exe

Loads dropped DLL 7 IoCs

Processes:

psr.exeeudcedit.exewisptis.exe

pid	Process
1248
2820	psr.exe
1248
2236	eudcedit.exe
1248
2288	wisptis.exe
1248

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mkmfyiwmvqjxba = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\TaskBar\\B61OII~1\\eudcedit.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exepsr.exeeudcedit.exewisptis.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	psr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eudcedit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wisptis.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
1464	rundll32.exe
1464	rundll32.exe
1464	rundll32.exe
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248
1248

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	procid_target
PID 1248 wrote to memory of 2876	1248	30
PID 1248 wrote to memory of 2876	1248	30
PID 1248 wrote to memory of 2876	1248	30
PID 1248 wrote to memory of 2820	1248	31
PID 1248 wrote to memory of 2820	1248	31
PID 1248 wrote to memory of 2820	1248	31
PID 1248 wrote to memory of 1352	1248	32
PID 1248 wrote to memory of 1352	1248	32
PID 1248 wrote to memory of 1352	1248	32
PID 1248 wrote to memory of 2236	1248	33
PID 1248 wrote to memory of 2236	1248	33
PID 1248 wrote to memory of 2236	1248	33
PID 1248 wrote to memory of 636	1248	34
PID 1248 wrote to memory of 636	1248	34
PID 1248 wrote to memory of 636	1248	34
PID 1248 wrote to memory of 2288	1248	35
PID 1248 wrote to memory of 2288	1248	35
PID 1248 wrote to memory of 2288	1248	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4af88f0bf58a337253e7ef9a79dc197102c9e3b2f156b0d5a54998d514ee3eeb.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Windows\system32\psr.exe
C:\Windows\system32\psr.exe
1⤵
PID:2876

C:\Users\Admin\AppData\Local\YwhXEx\psr.exe
C:\Users\Admin\AppData\Local\YwhXEx\psr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2820

C:\Windows\system32\eudcedit.exe
C:\Windows\system32\eudcedit.exe
1⤵
PID:1352

C:\Users\Admin\AppData\Local\mB2CUNsRQ\eudcedit.exe
C:\Users\Admin\AppData\Local\mB2CUNsRQ\eudcedit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2236

C:\Windows\system32\wisptis.exe
C:\Windows\system32\wisptis.exe
1⤵
PID:636

C:\Users\Admin\AppData\Local\bON3PVaPl\wisptis.exe
C:\Users\Admin\AppData\Local\bON3PVaPl\wisptis.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\YwhXEx\XmlLite.dll

Filesize
704KB

MD5
37333d135e0fa71c99cee94ff7adeb0b

SHA1
24b395026df50e5a52a37f248d913aa3ea54b5ac

SHA256
cab0d9f8ffd5d86619ba2e2045091b1839defa80491a368c1443c11a441e0e74

SHA512
7eaa17fbfe174767fdedc0dd79b5daa14b4f29a5d719c4204fc2fbbcad52a528a5decb000cadc9af50d478ed120f9c45d2b5dd30c44c6fb5512ceeddcfd8d8cd

Download Submit
C:\Users\Admin\AppData\Local\YwhXEx\psr.exe

Filesize
715KB

MD5
a80527109d75cba125d940b007eea151

SHA1
facf32a9ede6abfaa09368bfdfcfec8554107272

SHA256
68910f8aae867e938b6a3b76cdf176898ba275d9ade85b4ce00b03232de4c495

SHA512
77b86a597c33af8d3fbd9711f4abe6e0ca33b86279b1d28a25dcf3545a34b221be1ad7d11004d016203809cead1ebfd4b7e889ee9df2efc100eabf77963c1774

Download Submit
C:\Users\Admin\AppData\Local\bON3PVaPl\WTSAPI32.dll

Filesize
704KB

MD5
3411f1460038960230954e873cc12479

SHA1
80be21c85a7f2c88991abfb33dda5649cff442a0

SHA256
275481beb5c58109930e7bd3e78901b895730bc01ed4629a8b0b6462b37c8b2c

SHA512
283ea993d10b2b165947719d2ad80d88202ef331b71feb217e026aa599681f90845d770664f8e071f7d24fdd26d6cef4ea20add6d906ca449513719be829be97

Download Submit
C:\Users\Admin\AppData\Local\bON3PVaPl\wisptis.exe

Filesize
396KB

MD5
02e20372d9d6d28e37ba9704edc90b67

SHA1
d7d18ba0df95c3507bf20be8d72e25c5d11ab40c

SHA256
3338129ddf6fb53d6e743c10bc39ec372d9b2c39c607cbe8a71cff929f854144

SHA512
bcad8894614dcfc1429be04829c217e7c8ac3c40ea3927073de3421d96d9815739ee1b84f0200eb18b3b8406b972bd934204b7b31638c9fe7c297fb201ed4200

Download Submit
C:\Users\Admin\AppData\Local\mB2CUNsRQ\MFC42u.dll

Filesize
728KB

MD5
0533999b413a2f8b184dc55f11e83da3

SHA1
469891d190d0bee6b799ce6aa113057ba3ab3284

SHA256
53360b031cadd0921ece427880e6a02db7e1553f022be6a6ae2a78a9969dd5a4

SHA512
9b62030dc5eb6b2c9a6ed2194ff35cb69bb625bfc5ab8b565859f648291e1d47517cb06c2d56d8c8eca77a6c04b954d43c4b96ab98447258e1f9ee7e8f0d83bb

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ppapbotpack.lnk

Filesize
988B

MD5
ade368bcbca5dbfdf8e06fa68e235fc3

SHA1
bcb6325106fe312076529fd019982cfc1c091004

SHA256
aefae12f88f609364366b842ad73e21cc11fd339d02497d4a0b080cbf5b06800

SHA512
a8a4b0a93df05c77d63e78855cbe161d00bbc2e2eab703cb7b82e612a64be3bf35b458927769fd0cc0cb5fa9363b731aac935cb2096fc3dc3b142dc87c72db11

Download Submit
\Users\Admin\AppData\Local\mB2CUNsRQ\eudcedit.exe

Filesize
351KB

MD5
35e397d6ca8407b86d8a7972f0c90711

SHA1
6b39830003906ef82442522d22b80460c03f6082

SHA256
1f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde

SHA512
71b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e

Download Submit
memory/1248-25-0x0000000077080000-0x0000000077082000-memory.dmp

Filesize
8KB

Download
memory/1248-24-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-3-0x0000000076E16000-0x0000000076E17000-memory.dmp

Filesize
4KB

Download
memory/1248-15-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-14-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-12-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-10-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-11-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-36-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-35-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-9-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-8-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-23-0x0000000002AF0000-0x0000000002AF7000-memory.dmp

Filesize
28KB

Download
memory/1248-4-0x0000000002D10000-0x0000000002D11000-memory.dmp

Filesize
4KB

Download
memory/1248-45-0x0000000076E16000-0x0000000076E17000-memory.dmp

Filesize
4KB

Download
memory/1248-26-0x00000000770B0000-0x00000000770B2000-memory.dmp

Filesize
8KB

Download
memory/1248-13-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-6-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1248-7-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1464-44-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1464-2-0x0000000000290000-0x0000000000297000-memory.dmp

Filesize
28KB

Download
memory/1464-0-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2236-70-0x0000000000280000-0x0000000000287000-memory.dmp

Filesize
28KB

Download
memory/2236-71-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2236-75-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2288-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2820-58-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2820-53-0x0000000000610000-0x0000000000617000-memory.dmp

Filesize
28KB

Download
memory/2820-54-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download