dridex | 4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f

General

Target

4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll
Size

968KB
MD5

5453dd8223f092553390e303d02d3160
SHA1

db579b41e2b925e52a32d67c44d5efadcdb52c91
SHA256

4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f
SHA512

9b3f0cca2e9b8d1af6b86a232606a57a44480f08ecb5854539f517a56d229a7b3a227cf7415caee70f040ee79cdea6cce0139ec99776664785966467199ca82d
SSDEEP

12288:NqJ4FzHTx8cOjEIonNgQLtXKFg2t/KRi4BaedthD:NqGBHTxvt+g2gYedth

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1360-4-0x0000000001DB0000-0x0000000001DB1000-memory.dmp	dridex_stager_shellcode

Dridex payload 9 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/392-0-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1360-22-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1360-33-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/1360-34-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/392-42-0x0000000140000000-0x00000001400F2000-memory.dmp	dridex_payload
behavioral1/memory/2824-51-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_payload
behavioral1/memory/2824-56-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_payload
behavioral1/memory/2812-76-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_payload
behavioral1/memory/580-92-0x0000000140000000-0x00000001400F3000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

BitLockerWizardElev.exewscript.exeAdapterTroubleshooter.exe

pid process

2824 BitLockerWizardElev.exe
2812 wscript.exe
580 AdapterTroubleshooter.exe
Loads dropped DLL 8 IoCs

Processes:

BitLockerWizardElev.exewscript.exeAdapterTroubleshooter.exe

pid process

1360
2824 BitLockerWizardElev.exe
1360
1360
2812 wscript.exe
1360
580 AdapterTroubleshooter.exe
1360

pid	process
2824	BitLockerWizardElev.exe
2812	wscript.exe
580	AdapterTroubleshooter.exe

pid	process
1360
2824	BitLockerWizardElev.exe
1360
1360
2812	wscript.exe
1360
580	AdapterTroubleshooter.exe
1360

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgvptlq = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\MAINTE~1\\ww\\wscript.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeBitLockerWizardElev.exewscript.exeAdapterTroubleshooter.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BitLockerWizardElev.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	wscript.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdapterTroubleshooter.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
392	rundll32.exe
392	rundll32.exe
392	rundll32.exe
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360
1360

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1360 wrote to memory of 3016	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 3016	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 3016	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 2824	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 2824	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 2824	1360	BitLockerWizardElev.exe
PID 1360 wrote to memory of 900	1360	wscript.exe
PID 1360 wrote to memory of 900	1360	wscript.exe
PID 1360 wrote to memory of 900	1360	wscript.exe
PID 1360 wrote to memory of 2812	1360	wscript.exe
PID 1360 wrote to memory of 2812	1360	wscript.exe
PID 1360 wrote to memory of 2812	1360	wscript.exe
PID 1360 wrote to memory of 1688	1360	AdapterTroubleshooter.exe
PID 1360 wrote to memory of 1688	1360	AdapterTroubleshooter.exe
PID 1360 wrote to memory of 1688	1360	AdapterTroubleshooter.exe
PID 1360 wrote to memory of 580	1360	AdapterTroubleshooter.exe
PID 1360 wrote to memory of 580	1360	AdapterTroubleshooter.exe
PID 1360 wrote to memory of 580	1360	AdapterTroubleshooter.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4b9e28d775612f9c757d7f7daef0c07823e6764a5f6716a0b9d5e8ae21850d8f.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:392

C:\Windows\system32\BitLockerWizardElev.exe
C:\Windows\system32\BitLockerWizardElev.exe
1⤵
PID:3016

C:\Users\Admin\AppData\Local\6lNZ6l\BitLockerWizardElev.exe
C:\Users\Admin\AppData\Local\6lNZ6l\BitLockerWizardElev.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2824

C:\Windows\system32\wscript.exe
C:\Windows\system32\wscript.exe
1⤵
PID:900

C:\Users\Admin\AppData\Local\rEdE\wscript.exe
C:\Users\Admin\AppData\Local\rEdE\wscript.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2812

C:\Windows\system32\AdapterTroubleshooter.exe
C:\Windows\system32\AdapterTroubleshooter.exe
1⤵
PID:1688

C:\Users\Admin\AppData\Local\BZ1azGf\AdapterTroubleshooter.exe
C:\Users\Admin\AppData\Local\BZ1azGf\AdapterTroubleshooter.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\6lNZ6l\FVEWIZ.dll

Filesize
972KB

MD5
9a21be9d7ae6be29555202b88c2a90e9

SHA1
082a121e54302565fca19bb7bd8199931dd52559

SHA256
4fa0d9f9ff21c05ed50cab3613796511cb6d2f49f8f63e6e7fcd7d717e4f99ef

SHA512
fd92b63ce9965a014442be86d310f6cd8504dc974389f03056c409067b87329e715eee808a270a0ef55469e2fce0ca1efbd9ff0c789d63e788b0b4c79b61359b

Download Submit
C:\Users\Admin\AppData\Local\BZ1azGf\AdapterTroubleshooter.exe

Filesize
39KB

MD5
d4170c9ff5b2f85b0ce0246033d26919

SHA1
a76118e8775e16237cf00f2fb79718be0dc84db1

SHA256
d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da

SHA512
9c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608

Download Submit
C:\Users\Admin\AppData\Local\BZ1azGf\d3d9.dll

Filesize
972KB

MD5
1f61485dd7f93aaa64f7d6a06e139d8d

SHA1
1217541f9b61a718ebf085c9f0c07eface3c27a4

SHA256
ea1b05df54f5141fa60dab771dabee1ffe1c244c7acf473678fe972a26c64761

SHA512
9968e75177eda00838e9f4c26e9ea4a99759bb69c67e2d3fb1946371b834e4fc50436c832a3551dfa076762a54f344be34556118996dddada007d5594a422570

Download Submit
C:\Users\Admin\AppData\Local\rEdE\VERSION.dll

Filesize
972KB

MD5
3969b54189b077551851ba104c4f48d2

SHA1
90886d03ac449502f144f498183bfa5221685bc7

SHA256
27408bc3a801de896bb6fa6ebc8d70d4b8bec15ab2469938bf1326d8bf8cb6ab

SHA512
50a23f5d5e63f595a5afa5f5404be0546e7dfd65eab0a789ce87902b10cd68c0064daa676d3fc3a8aedc1a95c2475400f1ad01885987da54a9ec4b8cc509de67

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

Filesize
1KB

MD5
fe9f86c8215734aa1bd4bb978af5c261

SHA1
43cd73963e6be0ef8aaf217bf8479370f75d3a47

SHA256
40b98d939cf2e9c165c5691015d835914d99e5d6b954d014cc71428bba13fb00

SHA512
2640bd53e968c66dc278a73290c70caed8ddde5635991bfeac43aafbae98e05a494a3ae5cc52edf1c55126f8a6dcc6fa97fd1a595ad3e8dd2db7b772633d4d22

Download Submit
\Users\Admin\AppData\Local\6lNZ6l\BitLockerWizardElev.exe

Filesize
98KB

MD5
73f13d791e36d3486743244f16875239

SHA1
ed5ec55dbc6b3bda505f0a4c699c257c90c02020

SHA256
2483d2f0ad481005cca081a86a07be9060bc6d4769c4570f92ad96fa325be9b8

SHA512
911a7b532312d50cc5e7f6a046d46ab5b322aa17ce59a40477173ea50f000a95db45f169f4ea3574e3e00ae4234b9f8363ac79329d683c14ebee1d423e6e43af

Download Submit
\Users\Admin\AppData\Local\rEdE\wscript.exe

Filesize
165KB

MD5
8886e0697b0a93c521f99099ef643450

SHA1
851bd390bf559e702b8323062dbeb251d9f2f6f7

SHA256
d73f7ee4e6e992a618d02580bdbf4fd6ba7c683d110928001092f4073341e95f

SHA512
fc4a176f49a69c5600c427af72d3d274cfeacef48612b18cda966c3b4dda0b9d59c0fe8114d5ed8e0fec780744346e2cd503d1fd15c0c908908d067214b9d837

Download Submit
memory/392-0-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/392-2-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/392-42-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/580-92-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/1360-33-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-9-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-11-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-7-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-6-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-23-0x0000000077770000-0x0000000077772000-memory.dmp

Filesize
8KB

Download
memory/1360-34-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-24-0x00000000777A0000-0x00000000777A2000-memory.dmp

Filesize
8KB

Download
memory/1360-43-0x0000000077406000-0x0000000077407000-memory.dmp

Filesize
4KB

Download
memory/1360-21-0x0000000001D90000-0x0000000001D97000-memory.dmp

Filesize
28KB

Download
memory/1360-10-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-3-0x0000000077406000-0x0000000077407000-memory.dmp

Filesize
4KB

Download
memory/1360-4-0x0000000001DB0000-0x0000000001DB1000-memory.dmp

Filesize
4KB

Download
memory/1360-22-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-12-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-13-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/1360-8-0x0000000140000000-0x00000001400F2000-memory.dmp

Filesize
968KB

Download
memory/2812-71-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/2812-76-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/2824-56-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download
memory/2824-53-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2824-51-0x0000000140000000-0x00000001400F3000-memory.dmp

Filesize
972KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads