dridex | e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a

General

Target

e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll
Size

668KB
MD5

180c0aa7fe397e299b050b5a9fa20041
SHA1

7c6f6b915e18f322b65187b831cbb5f68ed02c09
SHA256

e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a
SHA512

822daa11c3f169efb36848e9ac0e0ad391d9401cb8d329cd3b9d1a0dc3d5aae029f356bded5dd625e44ba364fb615b861846c5d580dc7d65b4faeccc9ff5fea7
SSDEEP

6144:o34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:oIKp/UWCZdCDh2IZDwAFRpR6Au

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1268-4-0x0000000002A20000-0x0000000002A21000-memory.dmp	dridex_stager_shellcode

Dridex payload 12 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/3024-0-0x000007FEFAEE0000-0x000007FEFAF87000-memory.dmp	dridex_payload
behavioral1/memory/1268-16-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1268-24-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1268-36-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1268-35-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/3024-44-0x000007FEFAEE0000-0x000007FEFAF87000-memory.dmp	dridex_payload
behavioral1/memory/2528-54-0x000007FEFAF90000-0x000007FEFB038000-memory.dmp	dridex_payload
behavioral1/memory/2528-58-0x000007FEFAF90000-0x000007FEFB038000-memory.dmp	dridex_payload
behavioral1/memory/2732-70-0x000007FEF76F0000-0x000007FEF7798000-memory.dmp	dridex_payload
behavioral1/memory/2732-75-0x000007FEF76F0000-0x000007FEF7798000-memory.dmp	dridex_payload
behavioral1/memory/2764-87-0x000007FEF75A0000-0x000007FEF7648000-memory.dmp	dridex_payload
behavioral1/memory/2764-91-0x000007FEF75A0000-0x000007FEF7648000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

ddodiag.exeWindowsAnytimeUpgradeResults.exeshrpubw.exe

pid process

2528 ddodiag.exe
2732 WindowsAnytimeUpgradeResults.exe
2764 shrpubw.exe
Loads dropped DLL 7 IoCs

Processes:

ddodiag.exeWindowsAnytimeUpgradeResults.exeshrpubw.exe

pid process

1268
2528 ddodiag.exe
1268
2732 WindowsAnytimeUpgradeResults.exe
1268
2764 shrpubw.exe
1268

pid	process
2528	ddodiag.exe
2732	WindowsAnytimeUpgradeResults.exe
2764	shrpubw.exe

pid	process
1268
2528	ddodiag.exe
1268
2732	WindowsAnytimeUpgradeResults.exe
1268
2764	shrpubw.exe
1268

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kgvptlq = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\PRINTE~1\\WAI\\WINDOW~1.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeddodiag.exeWindowsAnytimeUpgradeResults.exeshrpubw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ddodiag.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WindowsAnytimeUpgradeResults.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	shrpubw.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
3024	rundll32.exe
3024	rundll32.exe
3024	rundll32.exe
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268
1268

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1268 wrote to memory of 2800	1268	ddodiag.exe
PID 1268 wrote to memory of 2800	1268	ddodiag.exe
PID 1268 wrote to memory of 2800	1268	ddodiag.exe
PID 1268 wrote to memory of 2528	1268	ddodiag.exe
PID 1268 wrote to memory of 2528	1268	ddodiag.exe
PID 1268 wrote to memory of 2528	1268	ddodiag.exe
PID 1268 wrote to memory of 2684	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 2684	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 2684	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 2732	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 2732	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 2732	1268	WindowsAnytimeUpgradeResults.exe
PID 1268 wrote to memory of 1736	1268	shrpubw.exe
PID 1268 wrote to memory of 1736	1268	shrpubw.exe
PID 1268 wrote to memory of 1736	1268	shrpubw.exe
PID 1268 wrote to memory of 2764	1268	shrpubw.exe
PID 1268 wrote to memory of 2764	1268	shrpubw.exe
PID 1268 wrote to memory of 2764	1268	shrpubw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\e36e53073055480f0401b56d3149b60bb3e47a95237eee92ba62f659b875e33a.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3024

C:\Windows\system32\ddodiag.exe
C:\Windows\system32\ddodiag.exe
1⤵
PID:2800

C:\Users\Admin\AppData\Local\CuIHXRfl\ddodiag.exe
C:\Users\Admin\AppData\Local\CuIHXRfl\ddodiag.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2528

C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
C:\Windows\system32\WindowsAnytimeUpgradeResults.exe
1⤵
PID:2684

C:\Users\Admin\AppData\Local\m4vuxXlH\WindowsAnytimeUpgradeResults.exe
C:\Users\Admin\AppData\Local\m4vuxXlH\WindowsAnytimeUpgradeResults.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2732

C:\Windows\system32\shrpubw.exe
C:\Windows\system32\shrpubw.exe
1⤵
PID:1736

C:\Users\Admin\AppData\Local\Vbk05vq\shrpubw.exe
C:\Users\Admin\AppData\Local\Vbk05vq\shrpubw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CuIHXRfl\XmlLite.dll

Filesize
672KB

MD5
5c66c1390dd51ee1ccc6302a939cf05a

SHA1
59ae5c3789b0fecbb22a52340fba4be18b8890b6

SHA256
565da5dcb3965c5f37cec38ca8593d0af76038a35637cebddd79d94d8fd76c26

SHA512
73f0efddec76879269809336c697fb126c5d74f1fa9514826c2086b590d9e933caa46f7f6336b56c0893858e524ddd6d69fcddd86931afdcba1eacfa5a02d6f7

Download Submit
C:\Users\Admin\AppData\Local\CuIHXRfl\ddodiag.exe

Filesize
42KB

MD5
509f9513ca16ba2f2047f5227a05d1a8

SHA1
fe8d63259cb9afa17da7b7b8ede4e75081071b1a

SHA256
ddf48c333e45c56c9e3f16e492c023bf138629f4c093b8aaab8ea60310c8c96e

SHA512
ad3168767e5eba575ae766e1e2923b1db4571bbeb302d7c58e8023612e33913dcd9e5f4a4c1bc7b1556442a0807117066f17c62b38fe2ae0dfaa3817b7318862

Download Submit
C:\Users\Admin\AppData\Local\Vbk05vq\shrpubw.exe

Filesize
398KB

MD5
29e6d0016611c8f948db5ea71372f76c

SHA1
01d007a01020370709cd6580717f9ace049647e8

SHA256
53c868882ebc9e0d4f703afeccb172043069ccc0b5b6f7cac1d2aad9c4640930

SHA512
300216ab47ee44b8f68d4835bf26641f949039522b680af00fb602f57d31c38812428dc624461bc2cc7d6384cad396bc033718e41e11a65f7dd0eeb36ed924e4

Download Submit
C:\Users\Admin\AppData\Local\Vbk05vq\srvcli.dll

Filesize
672KB

MD5
f76d42b693be75d25563d1d63044bc55

SHA1
671373b6350f2663f20b2b7cbbce7a934e62eee6

SHA256
e8b77de9f677699002aac697c360af692871891fa87c2c8449768bfd37441087

SHA512
a5a57772796a516caf0ff09a9e6c8540a7ab6ebd80f54f6f66677b35dbc3b416d6eb642044643bcd394f455b8b9058bfb508855df8cc9dcee6f5d5a0b4b7d2b2

Download Submit
C:\Users\Admin\AppData\Local\m4vuxXlH\WINBRAND.dll

Filesize
672KB

MD5
65f0ee31a5ea37def94def93372c6910

SHA1
55b1fe8143cb72fcd6e529018521c291bf62c8e1

SHA256
85271d9c2903369c4c89339fca29ca902f71c6ce951d60eedf4c868187cab01e

SHA512
efa4c4e681d131ba9640a6954baecc01c0148a37ea649022444f1c4f8fc771d75b4e7529fae5ffb964cc032cd775a95d43aa49ed8567b5969909ffe760425016

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wkybhziu.lnk

Filesize
1KB

MD5
1e9b92eb439cfeac55da9ab651bb53b5

SHA1
f70f9e42405bcddd13594088ccec6369e2c66d14

SHA256
6d98795358835369d4c2e30ba62e17c709d08b0c1eb79699511833253a3b541c

SHA512
cc5e9453364c65326516e9b9c750aecc9a0c8ec4cb47bbb38aa4dc9e0bc4d7764ac1ce8cc6eec0974b9d4acd2ee690849c8a915a3d15305c723542d2e8c88cc4

Download Submit
\Users\Admin\AppData\Local\m4vuxXlH\WindowsAnytimeUpgradeResults.exe

Filesize
288KB

MD5
6f3f29905f0ec4ce22c1fd8acbf6c6de

SHA1
68bdfefe549dfa6262ad659f1578f3e87d862773

SHA256
e9c4d718d09a28de8a99386b0dd65429f433837c712314e98ec4f01031af595b

SHA512
16a9ad3183d7e11d9f0dd3c79363aa9a7af306f4f35a6f1e0cc1e175ef254e8052ec94dfd600dbe882f9ab41254d482cce9190ab7b0c005a34e46c66e8ff5f9e

Download Submit
memory/1268-25-0x0000000077420000-0x0000000077422000-memory.dmp

Filesize
8KB

Download
memory/1268-45-0x00000000770B6000-0x00000000770B7000-memory.dmp

Filesize
4KB

Download
memory/1268-11-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-10-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-9-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-8-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-7-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-6-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-13-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-24-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-26-0x0000000077450000-0x0000000077452000-memory.dmp

Filesize
8KB

Download
memory/1268-3-0x00000000770B6000-0x00000000770B7000-memory.dmp

Filesize
4KB

Download
memory/1268-36-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-35-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-4-0x0000000002A20000-0x0000000002A21000-memory.dmp

Filesize
4KB

Download
memory/1268-12-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-14-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-15-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-16-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1268-23-0x0000000002A00000-0x0000000002A07000-memory.dmp

Filesize
28KB

Download
memory/2528-58-0x000007FEFAF90000-0x000007FEFB038000-memory.dmp

Filesize
672KB

Download
memory/2528-54-0x000007FEFAF90000-0x000007FEFB038000-memory.dmp

Filesize
672KB

Download
memory/2528-53-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2732-70-0x000007FEF76F0000-0x000007FEF7798000-memory.dmp

Filesize
672KB

Download
memory/2732-72-0x0000000000420000-0x0000000000427000-memory.dmp

Filesize
28KB

Download
memory/2732-75-0x000007FEF76F0000-0x000007FEF7798000-memory.dmp

Filesize
672KB

Download
memory/2764-87-0x000007FEF75A0000-0x000007FEF7648000-memory.dmp

Filesize
672KB

Download
memory/2764-91-0x000007FEF75A0000-0x000007FEF7648000-memory.dmp

Filesize
672KB

Download
memory/3024-44-0x000007FEFAEE0000-0x000007FEFAF87000-memory.dmp

Filesize
668KB

Download
memory/3024-2-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/3024-0-0x000007FEFAEE0000-0x000007FEFAF87000-memory.dmp

Filesize
668KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads