dridex | c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 01:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69.dll
Size

668KB
MD5

d5bde9d671851c1400307e33309c09a9
SHA1

381365bd2fdd24f20173279728db8dde2331115e
SHA256

c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69
SHA512

334e82ab5397434cc861ead66aff1456898386ca864711fbbcb791d6e4133b78dbfed5fcb65e07f45d885fb394830262bbdc271e949ce7572c70311a35eb14c1
SSDEEP

6144:m34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:mIKp/UWCZdCDh2IZDwAFRpR6Au

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1200-4-0x0000000002960000-0x0000000002961000-memory.dmp	dridex_stager_shellcode

Dridex payload 11 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral1/memory/1684-0-0x000007FEF7170000-0x000007FEF7217000-memory.dmp	dridex_payload
behavioral1/memory/1200-16-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1200-24-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1200-36-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1200-35-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1684-44-0x000007FEF7170000-0x000007FEF7217000-memory.dmp	dridex_payload
behavioral1/memory/2528-57-0x000007FEF7220000-0x000007FEF72C8000-memory.dmp	dridex_payload
behavioral1/memory/2528-61-0x000007FEF7220000-0x000007FEF72C8000-memory.dmp	dridex_payload
behavioral1/memory/2660-74-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp	dridex_payload
behavioral1/memory/2660-78-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp	dridex_payload
behavioral1/memory/736-94-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

pid	Process
2528	VaultSysUi.exe
2660	DWWIN.EXE
736	unregmp2.exe

Loads dropped DLL 8 IoCs

pid	Process
1200	Process not Found
1200	Process not Found
2528	VaultSysUi.exe
1200	Process not Found
2660	DWWIN.EXE
1200	Process not Found
736	unregmp2.exe
1200	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\Auwqk = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Office\\Recent\\1Gy9GHQg\\DWWIN.EXE"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	VaultSysUi.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DWWIN.EXE
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1684	rundll32.exe
1684	rundll32.exe
1684	rundll32.exe
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found
1200	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2608	1200	Process not Found	28
PID 1200 wrote to memory of 2608	1200	Process not Found	28
PID 1200 wrote to memory of 2608	1200	Process not Found	28
PID 1200 wrote to memory of 2528	1200	Process not Found	29
PID 1200 wrote to memory of 2528	1200	Process not Found	29
PID 1200 wrote to memory of 2528	1200	Process not Found	29
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2568	1200	Process not Found	30
PID 1200 wrote to memory of 2660	1200	Process not Found	31
PID 1200 wrote to memory of 2660	1200	Process not Found	31
PID 1200 wrote to memory of 2660	1200	Process not Found	31
PID 1200 wrote to memory of 592	1200	Process not Found	32
PID 1200 wrote to memory of 592	1200	Process not Found	32
PID 1200 wrote to memory of 592	1200	Process not Found	32
PID 1200 wrote to memory of 736	1200	Process not Found	33
PID 1200 wrote to memory of 736	1200	Process not Found	33
PID 1200 wrote to memory of 736	1200	Process not Found	33

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\c8a9440be1df2b7f93e4e7aa7407ea1a99c50e41f27524845d175ca81e6d4f69.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:1684

C:\Windows\system32\VaultSysUi.exe
C:\Windows\system32\VaultSysUi.exe
1⤵
PID:2608

C:\Users\Admin\AppData\Local\jOuvRU1bp\VaultSysUi.exe
C:\Users\Admin\AppData\Local\jOuvRU1bp\VaultSysUi.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2528

C:\Windows\system32\DWWIN.EXE
C:\Windows\system32\DWWIN.EXE
1⤵
PID:2568

C:\Users\Admin\AppData\Local\n1GTfwf\DWWIN.EXE
C:\Users\Admin\AppData\Local\n1GTfwf\DWWIN.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2660

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:592

C:\Users\Admin\AppData\Local\yAvHy\unregmp2.exe
C:\Users\Admin\AppData\Local\yAvHy\unregmp2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\jOuvRU1bp\credui.dll

Filesize
672KB

MD5
1bc379b7d86e9bace49aca97216ef232

SHA1
5428e7a331ce91a81425a1215c289ff54334d4a3

SHA256
a28aa528252891364750df511af6e18015dbfbfa148e51d211546188f92ff539

SHA512
58c4f40aaf0125c48973540c3c27bb0ddcd94833f9132e330f55a617856dacab265666517d34d7c0e94de1afea1f4969bf44e2ea17417fee6d0bd8c26a42816f

Download Submit
C:\Users\Admin\AppData\Local\n1GTfwf\VERSION.dll

Filesize
672KB

MD5
d4b520a19d0852eff3ff1871e84725d1

SHA1
e6cb443bca8736272cbb95e38455a113557ca705

SHA256
9413b8293bd92dd333e4a53fb60ad131b92293401c20ecaa61a1a112558482f1

SHA512
a414a66b47c03095fc9bcc3f052d991a65b16021a7c583b0d8ac810d757c695c85bd6d33669d3acd59e827d5f250242f5f994db830b7e797180cae9ca010742c

Download Submit
C:\Users\Admin\AppData\Local\yAvHy\VERSION.dll

Filesize
672KB

MD5
b630662eb1c739af8d9ef0c55ead3d29

SHA1
4811b38d52442311a677a7cd898f999557cae7e5

SHA256
424a64bd20f5f7550dcfb346e9b8f4da50651ecc3574dc49ae96fe3683e67b38

SHA512
314747e2190f470aa8a87a797bcfc49f86359a1cd9071b082feff8b66caac848bf82039ab2bdbda3111c7df908642d7b6c6c7e35e3bb99562e4506f62c24af06

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Ukatmrkmywz.lnk

Filesize
1KB

MD5
036a4a8537f11594084aadbbd6f8e1e6

SHA1
f51abab2b676251d0ab513e692abe0284cb03644

SHA256
9372337800f374c546ad50cfb49ecf27e6d5c7cca3d1cb816dee14c169691370

SHA512
800e202c3097192f37c2aae728aa96700a29c9006c71e25a2859bbe2fb760cf8916abf97618495f51748b2e952b7e37044c60b9172930e1a85c78bbc84144cad

Download Submit
\Users\Admin\AppData\Local\jOuvRU1bp\VaultSysUi.exe

Filesize
39KB

MD5
f40ef105d94350d36c799ee23f7fec0f

SHA1
ee3a5cfe8b807e1c1718a27eb97fa134360816e3

SHA256
eeb3f79be414b81f4eb8167390641787f14a033414533fb8de651c2247d054b2

SHA512
f16bcca6f6cecbdae117d5a41de7e86a6d9dfdfa2ce8c75ebff10d097083c106e7f9d030debed8cb20fdd71815a8aa7723a1d3c68b38ec382e55370331c594a1

Download Submit
\Users\Admin\AppData\Local\n1GTfwf\DWWIN.EXE

Filesize
149KB

MD5
25247e3c4e7a7a73baeea6c0008952b1

SHA1
8087adb7a71a696139ddc5c5abc1a84f817ab688

SHA256
c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050

SHA512
bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b

Download Submit
\Users\Admin\AppData\Local\yAvHy\unregmp2.exe

Filesize
316KB

MD5
64b328d52dfc8cda123093e3f6e4c37c

SHA1
f68f45b21b911906f3aa982e64504e662a92e5ab

SHA256
7d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1

SHA512
e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00

Download Submit
memory/736-94-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp

Filesize
672KB

Download
memory/1200-25-0x0000000077BE0000-0x0000000077BE2000-memory.dmp

Filesize
8KB

Download
memory/1200-24-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-15-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-14-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-13-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-12-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-11-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-9-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-8-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-26-0x0000000077C10000-0x0000000077C12000-memory.dmp

Filesize
8KB

Download
memory/1200-3-0x0000000077876000-0x0000000077877000-memory.dmp

Filesize
4KB

Download
memory/1200-36-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-35-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-4-0x0000000002960000-0x0000000002961000-memory.dmp

Filesize
4KB

Download
memory/1200-45-0x0000000077876000-0x0000000077877000-memory.dmp

Filesize
4KB

Download
memory/1200-23-0x0000000002940000-0x0000000002947000-memory.dmp

Filesize
28KB

Download
memory/1200-16-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-7-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-6-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1200-10-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1684-44-0x000007FEF7170000-0x000007FEF7217000-memory.dmp

Filesize
668KB

Download
memory/1684-0-0x000007FEF7170000-0x000007FEF7217000-memory.dmp

Filesize
668KB

Download
memory/1684-2-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/2528-61-0x000007FEF7220000-0x000007FEF72C8000-memory.dmp

Filesize
672KB

Download
memory/2528-57-0x000007FEF7220000-0x000007FEF72C8000-memory.dmp

Filesize
672KB

Download
memory/2528-56-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2660-73-0x0000000000180000-0x0000000000187000-memory.dmp

Filesize
28KB

Download
memory/2660-74-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp

Filesize
672KB

Download
memory/2660-78-0x000007FEF6C00000-0x000007FEF6CA8000-memory.dmp

Filesize
672KB

Download