dridex | 26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9

General

Target

26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9.dll
Size

700KB
MD5

eaad0504af393af4c5f770f1f921df14
SHA1

dedc04982b2d2728d5d11eb4f99d870ad89e1381
SHA256

26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9
SHA512

27329a5f0f89fc395320c1f1e1f9177e8a296dbc7125119760bdec56fee37e177685759b5ae8bec632ae4876dbc725b89c7ec8ffa40f9f97a6ee7214e9154dd8
SSDEEP

12288:tqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:tqGBHTxvt+g2gYed

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1252-4-0x0000000002DE0000-0x0000000002DE1000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1712-1-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1252-24-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1252-36-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1252-35-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1712-44-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2672-53-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2672-58-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/880-70-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/880-74-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/2584-90-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

mblctr.exeeudcedit.exeTpmInit.exe

pid process

2672 mblctr.exe
880 eudcedit.exe
2584 TpmInit.exe
Loads dropped DLL 7 IoCs

Processes:

mblctr.exeeudcedit.exeTpmInit.exe

pid process

1252
2672 mblctr.exe
1252
880 eudcedit.exe
1252
2584 TpmInit.exe
1252

pid	process
2672	mblctr.exe
880	eudcedit.exe
2584	TpmInit.exe

pid	process
1252
2672	mblctr.exe
1252
880	eudcedit.exe
1252
2584	TpmInit.exe
1252

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mkmfyiwmvqjxba = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\support\\cRYeF\\eudcedit.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemblctr.exeeudcedit.exeTpmInit.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mblctr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eudcedit.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	TpmInit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
1712	rundll32.exe
1712	rundll32.exe
1712	rundll32.exe
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252
1252

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1252 wrote to memory of 2180	1252	mblctr.exe
PID 1252 wrote to memory of 2180	1252	mblctr.exe
PID 1252 wrote to memory of 2180	1252	mblctr.exe
PID 1252 wrote to memory of 2672	1252	mblctr.exe
PID 1252 wrote to memory of 2672	1252	mblctr.exe
PID 1252 wrote to memory of 2672	1252	mblctr.exe
PID 1252 wrote to memory of 2848	1252	eudcedit.exe
PID 1252 wrote to memory of 2848	1252	eudcedit.exe
PID 1252 wrote to memory of 2848	1252	eudcedit.exe
PID 1252 wrote to memory of 880	1252	eudcedit.exe
PID 1252 wrote to memory of 880	1252	eudcedit.exe
PID 1252 wrote to memory of 880	1252	eudcedit.exe
PID 1252 wrote to memory of 2480	1252	TpmInit.exe
PID 1252 wrote to memory of 2480	1252	TpmInit.exe
PID 1252 wrote to memory of 2480	1252	TpmInit.exe
PID 1252 wrote to memory of 2584	1252	TpmInit.exe
PID 1252 wrote to memory of 2584	1252	TpmInit.exe
PID 1252 wrote to memory of 2584	1252	TpmInit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\26c86a299c2aa7f3db082b5b3769df68c7b6372909473112b6f17969113579d9.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1712

C:\Windows\system32\mblctr.exe
C:\Windows\system32\mblctr.exe
1⤵
PID:2180

C:\Users\Admin\AppData\Local\hsAjNH\mblctr.exe
C:\Users\Admin\AppData\Local\hsAjNH\mblctr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2672

C:\Windows\system32\eudcedit.exe
C:\Windows\system32\eudcedit.exe
1⤵
PID:2848

C:\Users\Admin\AppData\Local\eSBfSOKZ\eudcedit.exe
C:\Users\Admin\AppData\Local\eSBfSOKZ\eudcedit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:880

C:\Windows\system32\TpmInit.exe
C:\Windows\system32\TpmInit.exe
1⤵
PID:2480

C:\Users\Admin\AppData\Local\TbOAR\TpmInit.exe
C:\Users\Admin\AppData\Local\TbOAR\TpmInit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\TbOAR\ACTIVEDS.dll

Filesize
704KB

MD5
a37882c1e7819a02573e59b87727608e

SHA1
2777d3bb63b2196b2df0b5b9e4fbcecc3013fd1c

SHA256
1be7e56723baef624e1a4dbdb697d3d22e888ebf57fe62bdee8f4cf96781b666

SHA512
fac1c7987308843506527580b8781c978b2da16fb8fe09b0ea5eebf6a986121b5917eec3e839e7c97829cf6d17e98f007ca24f77308ef394b531f89e33c6f88d

Download Submit
C:\Users\Admin\AppData\Local\TbOAR\TpmInit.exe

Filesize
112KB

MD5
8b5eb38e08a678afa129e23129ca1e6d

SHA1
a27d30bb04f9fabdb5c92d5150661a75c5c7bc42

SHA256
4befa614e1b434b2f58c9e7ce947a946b1cf1834b219caeff42b3e36f22fd97c

SHA512
a7245cde299c68db85370ae1bdf32a26208e2cda1311afd06b0efd410664f36cafb62bf4b7ce058e203dcc515c45ebdef01543779ead864f3154175b7b36647d

Download Submit
C:\Users\Admin\AppData\Local\eSBfSOKZ\MFC42u.dll

Filesize
728KB

MD5
ad4d603450069861ac40224e61897f72

SHA1
904b0a41d7412eca810aa0a8afc15fcd98862963

SHA256
d5947cb7e5614152b15de30a1018bc165db51bbf4b8a6944221c559137a2a1f0

SHA512
11eb102ecd868d6df9b62bbfc72b5c33095582eb99b6cc47c8ae7d6a856c790694a3809520b9fe081344daa4f506f49f49f619b14b3d1d520e0c550b93b4920f

Download Submit
C:\Users\Admin\AppData\Local\eSBfSOKZ\eudcedit.exe

Filesize
351KB

MD5
35e397d6ca8407b86d8a7972f0c90711

SHA1
6b39830003906ef82442522d22b80460c03f6082

SHA256
1f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde

SHA512
71b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e

Download Submit
C:\Users\Admin\AppData\Local\hsAjNH\mblctr.exe

Filesize
935KB

MD5
fa4c36b574bf387d9582ed2c54a347a8

SHA1
149077715ee56c668567e3a9cb9842284f4fe678

SHA256
b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f

SHA512
1f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55

Download Submit
C:\Users\Admin\AppData\Local\hsAjNH\slc.dll

Filesize
704KB

MD5
855aacaca68c83322a2405061582baad

SHA1
722db1527a72c6e0f7148a19b132167987e2f0ba

SHA256
24192f96c66f1fa0168d7dae5bfc9009fdfcc0bcc1d4e8a44a496fa477a8d002

SHA512
81c4c3986901b38515dcd33079c0aa0396d10b3fd93e74c7fff103465c729730e54d3e71305d773fbd8a10d8160ab00c52897a3a006d3fab4a6d4811cf22bfec

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ppapbotpack.lnk

Filesize
981B

MD5
2411294442123f513b93c92bfb16930c

SHA1
4d5319b7e078a3d7eb7ee1d09c2c1a1c718654e6

SHA256
ace01661188eb6f9d6cf6874e64268ddab4f7b792f5ec073138d6b6d7eabad43

SHA512
b2e5bec0133417dec4f06560ceab3acbdddc7653d8dbaa09536017412d0ff6f48f7df3da40ca7f1357cd8d6c461f2c9a1d9c609df2e21f4797b66abd37458db0

Download Submit
memory/880-74-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/880-70-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1252-8-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-23-0x0000000002DC0000-0x0000000002DC7000-memory.dmp

Filesize
28KB

Download
memory/1252-14-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-12-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-9-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-11-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-10-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-3-0x0000000077526000-0x0000000077527000-memory.dmp

Filesize
4KB

Download
memory/1252-7-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-36-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-35-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-4-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Filesize
4KB

Download
memory/1252-45-0x0000000077526000-0x0000000077527000-memory.dmp

Filesize
4KB

Download
memory/1252-25-0x0000000077790000-0x0000000077792000-memory.dmp

Filesize
8KB

Download
memory/1252-26-0x00000000777C0000-0x00000000777C2000-memory.dmp

Filesize
8KB

Download
memory/1252-6-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-13-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-24-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1252-15-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1712-44-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1712-0-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/1712-1-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2584-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2672-58-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2672-55-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2672-53-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads