dridex | 4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549

General

Target

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll
Size

700KB
MD5

bfbcb9e4b4723629dda33d1406a87d3a
SHA1

d342007297faf30e3cd1a703b31287e735470858
SHA256

4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549
SHA512

d0679c2dead14ccc998bf6ae31c79e3e4570a345401374a099e2feb3252eb1a2a2159b559a0963523f39e4080d6ecf672d2c397c12cdce7d1a142c7eb81afd41
SSDEEP

12288:dEwgKnIhABTW0HcD5a1PKxdZhC+k+V9Hgeb/tf/B9P632vHAA:dEwXnOAx5HcDM1Sxd3ChCHg2/P9yGo

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1224-4-0x00000000025C0000-0x00000000025C1000-memory.dmp	dridex_stager_shellcode

Dridex payload 9 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2216-1-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1224-24-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1224-36-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/1224-35-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2216-44-0x0000000140000000-0x00000001400AF000-memory.dmp	dridex_payload
behavioral1/memory/2484-54-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2484-58-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/2104-75-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload
behavioral1/memory/1476-90-0x0000000140000000-0x00000001400B0000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

raserver.exemstsc.exemblctr.exe

pid process

2484 raserver.exe
2104 mstsc.exe
1476 mblctr.exe
Loads dropped DLL 7 IoCs

Processes:

raserver.exemstsc.exemblctr.exe

pid process

1224
2484 raserver.exe
1224
2104 mstsc.exe
1224
1476 mblctr.exe
1224

pid	process
2484	raserver.exe
2104	mstsc.exe
1476	mblctr.exe

pid	process
1224
2484	raserver.exe
1224
2104	mstsc.exe
1224
1476	mblctr.exe
1224

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\Rcoehfpd = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\oeBZAl0\\mstsc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeraserver.exemstsc.exemblctr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	raserver.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mstsc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mblctr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2216	rundll32.exe
2216	rundll32.exe
2216	rundll32.exe
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224
1224

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1224 wrote to memory of 2968	1224	raserver.exe
PID 1224 wrote to memory of 2968	1224	raserver.exe
PID 1224 wrote to memory of 2968	1224	raserver.exe
PID 1224 wrote to memory of 2484	1224	raserver.exe
PID 1224 wrote to memory of 2484	1224	raserver.exe
PID 1224 wrote to memory of 2484	1224	raserver.exe
PID 1224 wrote to memory of 1372	1224	mstsc.exe
PID 1224 wrote to memory of 1372	1224	mstsc.exe
PID 1224 wrote to memory of 1372	1224	mstsc.exe
PID 1224 wrote to memory of 2104	1224	mstsc.exe
PID 1224 wrote to memory of 2104	1224	mstsc.exe
PID 1224 wrote to memory of 2104	1224	mstsc.exe
PID 1224 wrote to memory of 1692	1224	mblctr.exe
PID 1224 wrote to memory of 1692	1224	mblctr.exe
PID 1224 wrote to memory of 1692	1224	mblctr.exe
PID 1224 wrote to memory of 1476	1224	mblctr.exe
PID 1224 wrote to memory of 1476	1224	mblctr.exe
PID 1224 wrote to memory of 1476	1224	mblctr.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\4ac846154d1f91c30a373dc364d880d7f36b0d1f23edbf8e854b38b804db7549.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2216

C:\Windows\system32\raserver.exe
C:\Windows\system32\raserver.exe
1⤵
PID:2968

C:\Users\Admin\AppData\Local\VqB5bMR\raserver.exe
C:\Users\Admin\AppData\Local\VqB5bMR\raserver.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2484

C:\Windows\system32\mstsc.exe
C:\Windows\system32\mstsc.exe
1⤵
PID:1372

C:\Users\Admin\AppData\Local\EuRYnCy\mstsc.exe
C:\Users\Admin\AppData\Local\EuRYnCy\mstsc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2104

C:\Windows\system32\mblctr.exe
C:\Windows\system32\mblctr.exe
1⤵
PID:1692

C:\Users\Admin\AppData\Local\sU7Zy\mblctr.exe
C:\Users\Admin\AppData\Local\sU7Zy\mblctr.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\EuRYnCy\credui.dll

Filesize
704KB

MD5
f61273957865c1a5b5e63bde0c3a61e1

SHA1
f1ae3f2ca18fd6adcad0a14e2706f260bd68e3b0

SHA256
48ea3db50d79c6194f9572858f97e865781e460bb6313b1d9a1bb53fd89accf9

SHA512
d9429c7f62b5122892b73ee66b33e983bbcac6fb98452ad8a2ff99709609f85f933df369f1be99c76004e469a5e57dc9ec97426b13b3548317932ee7f619cbaa

Download Submit
C:\Users\Admin\AppData\Local\VqB5bMR\WTSAPI32.dll

Filesize
704KB

MD5
3034b61bc4388c0b5465eecbe57a2342

SHA1
c03c70048b618b3268723ab2dc9ca85cf8c1ef11

SHA256
9ec17e6a09e88c71952dfc208478e4931ab006316ade967e26b6ccd665d91454

SHA512
73391d796b7c8764c0fcfc37b8bf33b621b2a6cc4629ec29f2458fe4d7c60d4d78e3ea3fc99d7c49fb6e216dc03ab50a338e4d06b7bfe6642473b942c97d0328

Download Submit
C:\Users\Admin\AppData\Local\sU7Zy\WTSAPI32.dll

Filesize
704KB

MD5
9ab00bbccace510ac4a34b8439aa1f83

SHA1
c79bade33a7f816e27c23702ced05095bdb41e7e

SHA256
5bd36ba5e3a120a8d9b200f88ed547a77a636dc07319059136979cb7d9f83ab6

SHA512
15ac1b2934c2c0b8e2c4873fcb2275d2438ddf0275a40fa556113915cd00a7674856ac07dfbf034503824ff77d9a098d8768ea7afce09e79d676617fb15a2abf

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yjafzwirjcl.lnk

Filesize
1KB

MD5
aca2eea6361a0df1b8d570dd5d723957

SHA1
2b0f37fc8cdadcbf660b33d245fb4a980e29303f

SHA256
718e01731acbb710fd92dee3ed7517a5a817b62c3cfa6b29e53426290bbd153a

SHA512
ba77030d367e3a9d8e4034dc3dc825f84079dce7ed8faeb6efe439a6b8a1a3e98709b48caef7c7bcda5b26584db67f02d84e9d5b022f097aeacbc3b0d1e14187

Download Submit
\Users\Admin\AppData\Local\EuRYnCy\mstsc.exe

Filesize
1.1MB

MD5
50f739538ef014b2e7ec59431749d838

SHA1
b439762b8efe8cfb977e7374c11a7e4d8ed05eb3

SHA256
85c510c7fa8d64c70886ea01ec99e7b9064594f021a95b4cf88359421e732be3

SHA512
02e231ddc4ac012c597b9db42f8a77fbf35ca8253c030d443a0dd4db3d76a9ee1cced600f12d7bb06305e7a4da4a8fda980faad335adcb12738d80d453cb3cc8

Download Submit
\Users\Admin\AppData\Local\VqB5bMR\raserver.exe

Filesize
123KB

MD5
cd0bc0b6b8d219808aea3ecd4e889b19

SHA1
9f8f4071ce2484008e36fdfd963378f4ebad703f

SHA256
16abc530c0367df1ad631f09e14c565cf99561949aa14acc533cd54bf8a5e22c

SHA512
84291ea3fafb38ef96817d5fe4a972475ef8ea24a4353568029e892fa8e15cf8e8f6ef4ff567813cd3b38092f0db4577d9dccb22be755eebdd4f77e623dc80ac

Download Submit
\Users\Admin\AppData\Local\sU7Zy\mblctr.exe

Filesize
935KB

MD5
fa4c36b574bf387d9582ed2c54a347a8

SHA1
149077715ee56c668567e3a9cb9842284f4fe678

SHA256
b71cdf708d4a4f045f784de5e5458ebf9a4fa2b188c3f7422e2fbfe19310be3f

SHA512
1f04ce0440eec7477153ebc2ce56eaabcbbac58d9d703c03337f030e160d22cd635ae201752bc2962643c75bbf2036afdd69d97e8cbc81260fd0e2f55946bb55

Download Submit
memory/1224-26-0x0000000077BD0000-0x0000000077BD2000-memory.dmp

Filesize
8KB

Download
memory/1224-36-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-14-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-13-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-12-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-11-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-9-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-24-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-7-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-6-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-25-0x0000000077BA0000-0x0000000077BA2000-memory.dmp

Filesize
8KB

Download
memory/1224-8-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-35-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-23-0x00000000025A0000-0x00000000025A7000-memory.dmp

Filesize
28KB

Download
memory/1224-45-0x0000000077836000-0x0000000077837000-memory.dmp

Filesize
4KB

Download
memory/1224-15-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-10-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/1224-3-0x0000000077836000-0x0000000077837000-memory.dmp

Filesize
4KB

Download
memory/1224-4-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1476-90-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2104-75-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2104-70-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2216-44-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2216-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2216-1-0x0000000140000000-0x00000001400AF000-memory.dmp

Filesize
700KB

Download
memory/2484-58-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2484-54-0x0000000140000000-0x00000001400B0000-memory.dmp

Filesize
704KB

Download
memory/2484-53-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads