dridex | 6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf

General

Target

6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf.dll
Size

728KB
MD5

3a325295832f70c883b27b87efa606c6
SHA1

920e9216016a61f1323024604facdb3fa3d4739a
SHA256

6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf
SHA512

8908496ecd06be35afaf723601ec8478f8b6d1805bf390f5fbb2301db21d0872b0b63f4dbdfb1f9d03db8ecd721a697a49a6eb79d6d5d3e2f173e3176cc7c05f
SSDEEP

12288:pqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4Baed:pqGBHTxvt+g2gYed

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1208-4-0x0000000002DF0000-0x0000000002DF1000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2092-0-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/1208-24-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/1208-35-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/1208-36-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/2092-44-0x0000000140000000-0x00000001400B6000-memory.dmp	dridex_payload
behavioral1/memory/2684-53-0x0000000140000000-0x00000001400B7000-memory.dmp	dridex_payload
behavioral1/memory/2684-58-0x0000000140000000-0x00000001400B7000-memory.dmp	dridex_payload
behavioral1/memory/2560-75-0x0000000140000000-0x00000001400B7000-memory.dmp	dridex_payload
behavioral1/memory/684-87-0x0000000140000000-0x00000001400B8000-memory.dmp	dridex_payload
behavioral1/memory/684-91-0x0000000140000000-0x00000001400B8000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

BdeUISrv.exerdrleakdiag.exemblctr.exe

pid process

2684 BdeUISrv.exe
2560 rdrleakdiag.exe
684 mblctr.exe
Loads dropped DLL 7 IoCs

Processes:

BdeUISrv.exerdrleakdiag.exemblctr.exe

pid process

1208
2684 BdeUISrv.exe
1208
2560 rdrleakdiag.exe
1208
684 mblctr.exe
1208

pid	process
2684	BdeUISrv.exe
2560	rdrleakdiag.exe
684	mblctr.exe

pid	process
1208
2684	BdeUISrv.exe
1208
2560	rdrleakdiag.exe
1208
684	mblctr.exe
1208

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rtunysabu = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\PrivacIE\\DJcnj1SUj\\rdrleakdiag.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeBdeUISrv.exerdrleakdiag.exemblctr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BdeUISrv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdrleakdiag.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mblctr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exeBdeUISrv.exe

pid	process
2092	rundll32.exe
2092	rundll32.exe
2092	rundll32.exe
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
1208
2684	BdeUISrv.exe
2684	BdeUISrv.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1208 wrote to memory of 2716	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2716	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2716	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2684	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2684	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2684	1208	BdeUISrv.exe
PID 1208 wrote to memory of 2796	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 2796	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 2796	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 2560	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 2560	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 2560	1208	rdrleakdiag.exe
PID 1208 wrote to memory of 3052	1208	mblctr.exe
PID 1208 wrote to memory of 3052	1208	mblctr.exe
PID 1208 wrote to memory of 3052	1208	mblctr.exe
PID 1208 wrote to memory of 684	1208	mblctr.exe
PID 1208 wrote to memory of 684	1208	mblctr.exe
PID 1208 wrote to memory of 684	1208	mblctr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6148532826cdbfc9b12295ce641021f22336459ea6f5cd2de43dec5f18e648bf.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2092

C:\Windows\system32\BdeUISrv.exe
C:\Windows\system32\BdeUISrv.exe
1⤵
PID:2716

C:\Users\Admin\AppData\Local\EoZDN\BdeUISrv.exe
C:\Users\Admin\AppData\Local\EoZDN\BdeUISrv.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2684

C:\Windows\system32\rdrleakdiag.exe
C:\Windows\system32\rdrleakdiag.exe
1⤵
PID:2796

C:\Users\Admin\AppData\Local\o6v6\rdrleakdiag.exe
C:\Users\Admin\AppData\Local\o6v6\rdrleakdiag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2560

C:\Windows\system32\mblctr.exe
C:\Windows\system32\mblctr.exe
1⤵
PID:3052

C:\Users\Admin\AppData\Local\5XOv3\mblctr.exe
C:\Users\Admin\AppData\Local\5XOv3\mblctr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\5XOv3\WINMM.dll

Filesize
736KB

MD5
d0087970f71f59b7acb8d08c333c7288

SHA1
0a7dd6fa99389f76724630397c3bd281434144b5

SHA256
a16c9f1275bcf9c8a475def152ca74d9192b4fef1e4e8546dfe7399637abcd65

SHA512
973dc606ccef80c22900bd6ec2ac0b780b00677c01c47417ff1d27f1848e64784bbed2d72e0d1bf93d7486d5624f397a68d171bb0fdb19e0eb8dd0b937daeddd

Download Submit
C:\Users\Admin\AppData\Local\5XOv3\mblctr.exe

Filesize
935KB

MD5
fa4c36b574bf387d9582ed2c54a347a8

SHA1
149077715ee56c668567e3a9cb9842284f4fe678

SHA256
b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f

SHA512
1f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55

Download Submit
C:\Users\Admin\AppData\Local\EoZDN\WTSAPI32.dll

Filesize
732KB

MD5
cf73075797cfdbea15d12cbf64a1f93b

SHA1
19a5df51627487df743c5632a4466cde224fea73

SHA256
a901be41d6b35eaaeec987a86885ea11dd71817c8abe4480f2d09da735af5d71

SHA512
1f60f0d4c32dfe2247825ed75af409b790a87e691f88ebc045be19778c2478e6330bf2936030b7a097191ccec0babc633f377e01839f19f9e05d8c9c24eaf6d7

Download Submit
C:\Users\Admin\AppData\Local\o6v6\wer.dll

Filesize
732KB

MD5
894e50b04b6a6f0ff6b9f232cc1a9747

SHA1
b87d02a7100d9d04dd5eda8e8b55231712681dee

SHA256
0a63caf5cbba1a36a5a353dc5ec2716298b66d02e6d664db7eecb1b9344812ef

SHA512
00a90e086ca532ec20caee8a3bd16c08e2918b6425d300bafcf8b1b0eb277ad22ac7c0a1fcff88679c0f046ff7619ddd8edfce7f2aaad61c171b9160a11f24eb

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Gwifj.lnk

Filesize
1KB

MD5
d545e7a332b9b412e0cdd513743e516d

SHA1
2f5ae74928f6d6793bdfcc0cf8f6ce7ea56b5e6f

SHA256
6c86b6aa2a29e97a5394583c4de68e164653936321bfae96709daf310cfacab0

SHA512
b20d5d2d4fe4318f330666984cbc11b8e30b20832931b515413761efb182c0918f0619476328dac63d43052de33851474e7aba9ecd0f91b0fda40fe4d50a3575

Download Submit
\Users\Admin\AppData\Local\EoZDN\BdeUISrv.exe

Filesize
47KB

MD5
1da6b19be5d4949c868a264bc5e74206

SHA1
d5ee86ba03a03ef8c93d93accafe40461084c839

SHA256
00330a0e0eb1dbb6ee84997963f8e15c7c15c1df787f1c7f109609d7b31bd35c

SHA512
9cee858c55eb0852e5bad53a675a094ae591b46b07afe9fb4224cac32e0be577fe36c1ed3e9f6bda4d4eb0c924a773d00e3181cd97f07e24c6c68c70f2b002c6

Download Submit
\Users\Admin\AppData\Local\o6v6\rdrleakdiag.exe

Filesize
39KB

MD5
5e058566af53848541fa23fba4bb5b81

SHA1
769ce3bfc45e4d56ed01dbeeeca7be22f9b9eed6

SHA256
ae83b050fa722da7e4b19fc3d534f0126b1ec055643bb1f267b85b55160f4409

SHA512
352029cf0af7583a4c525cfd1da7467446bac410a885b2768d8052f39577ccce85b21d5bd946be6bf8341e7308c8e4f645e4d79232b93aaf6a92d6cd55f598d0

Download Submit
memory/684-91-0x0000000140000000-0x00000001400B8000-memory.dmp

Filesize
736KB

Download
memory/684-87-0x0000000140000000-0x00000001400B8000-memory.dmp

Filesize
736KB

Download
memory/1208-11-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-8-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-16-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-15-0x0000000002170000-0x0000000002177000-memory.dmp

Filesize
28KB

Download
memory/1208-14-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-13-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-24-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-26-0x00000000773B0000-0x00000000773B2000-memory.dmp

Filesize
8KB

Download
memory/1208-25-0x0000000077380000-0x0000000077382000-memory.dmp

Filesize
8KB

Download
memory/1208-35-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-36-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-3-0x0000000077016000-0x0000000077017000-memory.dmp

Filesize
4KB

Download
memory/1208-45-0x0000000077016000-0x0000000077017000-memory.dmp

Filesize
4KB

Download
memory/1208-4-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

Filesize
4KB

Download
memory/1208-10-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-6-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-7-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-12-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/1208-9-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2092-0-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2092-44-0x0000000140000000-0x00000001400B6000-memory.dmp

Filesize
728KB

Download
memory/2092-2-0x0000000000320000-0x0000000000327000-memory.dmp

Filesize
28KB

Download
memory/2560-72-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/2560-75-0x0000000140000000-0x00000001400B7000-memory.dmp

Filesize
732KB

Download
memory/2684-58-0x0000000140000000-0x00000001400B7000-memory.dmp

Filesize
732KB

Download
memory/2684-55-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2684-53-0x0000000140000000-0x00000001400B7000-memory.dmp

Filesize
732KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads