dridex | a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763

General

Target

a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763.dll
Size

668KB
MD5

f1fef96e70f11bcc6f67cb15fa1d2220
SHA1

981d5a3fe6ed1b02bdd9dee4daf3d4777b17dbb2
SHA256

a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763
SHA512

34e7dcb270ab5cd8838c5fd036fe2fd060619f18ff33a1803e5aac3a5fedb198642ab051f8d63a9410ed8864e0ea2c2cb1c0fb968f9abed72e2cb954d1fb5258
SSDEEP

6144:+34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:+IKp/UWCZdCDh2IZDwAFRpR6Au

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1212-4-0x0000000002150000-0x0000000002151000-memory.dmp	dridex_stager_shellcode

Dridex payload 11 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2360-0-0x000007FEF6F90000-0x000007FEF7037000-memory.dmp	dridex_payload
behavioral1/memory/1212-16-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1212-24-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1212-37-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/1212-35-0x0000000140000000-0x00000001400A7000-memory.dmp	dridex_payload
behavioral1/memory/2360-44-0x000007FEF6F90000-0x000007FEF7037000-memory.dmp	dridex_payload
behavioral1/memory/2936-54-0x000007FEF7040000-0x000007FEF70E8000-memory.dmp	dridex_payload
behavioral1/memory/2936-58-0x000007FEF7040000-0x000007FEF70E8000-memory.dmp	dridex_payload
behavioral1/memory/2816-71-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp	dridex_payload
behavioral1/memory/2816-75-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp	dridex_payload
behavioral1/memory/3064-91-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

AdapterTroubleshooter.exeDWWIN.EXEicardagt.exe

pid process

2936 AdapterTroubleshooter.exe
2816 DWWIN.EXE
3064 icardagt.exe
Loads dropped DLL 7 IoCs

Processes:

AdapterTroubleshooter.exeDWWIN.EXEicardagt.exe

pid process

1212
2936 AdapterTroubleshooter.exe
1212
2816 DWWIN.EXE
1212
3064 icardagt.exe
1212

pid	process
2936	AdapterTroubleshooter.exe
2816	DWWIN.EXE
3064	icardagt.exe

pid	process
1212
2936	AdapterTroubleshooter.exe
1212
2816	DWWIN.EXE
1212
3064	icardagt.exe
1212

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bvqjtr = "C:\\Users\\Admin\\AppData\\Roaming\\Macromedia\\Guknd85IKfh\\DWWIN.EXE"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

icardagt.exerundll32.exeAdapterTroubleshooter.exeDWWIN.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icardagt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdapterTroubleshooter.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DWWIN.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2360	rundll32.exe
2360	rundll32.exe
2360	rundll32.exe
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212
1212

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1212 wrote to memory of 2812	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2812	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2812	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2936	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2936	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2936	1212	AdapterTroubleshooter.exe
PID 1212 wrote to memory of 2756	1212	DWWIN.EXE
PID 1212 wrote to memory of 2756	1212	DWWIN.EXE
PID 1212 wrote to memory of 2756	1212	DWWIN.EXE
PID 1212 wrote to memory of 2816	1212	DWWIN.EXE
PID 1212 wrote to memory of 2816	1212	DWWIN.EXE
PID 1212 wrote to memory of 2816	1212	DWWIN.EXE
PID 1212 wrote to memory of 1920	1212	icardagt.exe
PID 1212 wrote to memory of 1920	1212	icardagt.exe
PID 1212 wrote to memory of 1920	1212	icardagt.exe
PID 1212 wrote to memory of 3064	1212	icardagt.exe
PID 1212 wrote to memory of 3064	1212	icardagt.exe
PID 1212 wrote to memory of 3064	1212	icardagt.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a61afcc952dbc670a70569043015ae03ae3704ae4c6023bf85e2df86ec4c7763.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2360

C:\Windows\system32\AdapterTroubleshooter.exe
C:\Windows\system32\AdapterTroubleshooter.exe
1⤵
PID:2812

C:\Users\Admin\AppData\Local\rHLS4\AdapterTroubleshooter.exe
C:\Users\Admin\AppData\Local\rHLS4\AdapterTroubleshooter.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2936

C:\Windows\system32\DWWIN.EXE
C:\Windows\system32\DWWIN.EXE
1⤵
PID:2756

C:\Users\Admin\AppData\Local\tylzHc\DWWIN.EXE
C:\Users\Admin\AppData\Local\tylzHc\DWWIN.EXE
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2816

C:\Windows\system32\icardagt.exe
C:\Windows\system32\icardagt.exe
1⤵
PID:1920

C:\Users\Admin\AppData\Local\ygw8tKR\icardagt.exe
C:\Users\Admin\AppData\Local\ygw8tKR\icardagt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\rHLS4\AdapterTroubleshooter.exe

Filesize
39KB

MD5
d4170c9ff5b2f85b0ce0246033d26919

SHA1
a76118e8775e16237cf00f2fb79718be0dc84db1

SHA256
d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da

SHA512
9c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608

Download Submit
C:\Users\Admin\AppData\Local\rHLS4\d3d9.dll

Filesize
672KB

MD5
7df62704b922fda6a5a121946fc8ba86

SHA1
f866fcedcfefca9e5542dc06ee660cf4595b5d2c

SHA256
e5351167d93ff0eff1e36d3fb2dffac897db3a60b8a02fef8a07a906412700df

SHA512
5fb15e03c253c80789106125a931a1f72f8a277c7efc1759f4eee64dc3a5192c11008387788b27d7a5134527cfbdd87632f92e751267ec90d312165220c546b1

Download Submit
C:\Users\Admin\AppData\Local\tylzHc\wer.dll

Filesize
672KB

MD5
7bf32ac4b77d9cfb85edb844fcbd4567

SHA1
e76e5a76463ccec23f2ce4030416ef8f6b603f4f

SHA256
26ee098ce1e117a39cf4e9ba5872aadc7eb85b46388845b87161b7c10e8618fc

SHA512
0d24d9b02e07c84e163e483c3cfb37c59c02fa4e94db74484cf6ab28c9a1ea8b40629696ae3386ef4ccdd3779a0af74956e3d21ed780be8e8e64d7f120b5b887

Download Submit
C:\Users\Admin\AppData\Local\ygw8tKR\UxTheme.dll

Filesize
672KB

MD5
384c6e2f7a71d6778ae2da868c115a2a

SHA1
cbc567363303315cfadbda5d30c351fb4f87e2a5

SHA256
0f67c4249c96922d89eeb25da8e28d07daed6e0825fbaf65268cf1e6d132144f

SHA512
d6b0f2a85ca45ae127217c5791d73dfe8f9742226e4a18773076fa05cab8187d188f0820dfe36cc94765f5755be352839ceea39987bd236d93a659bcd675a84e

Download Submit
C:\Users\Admin\AppData\Local\ygw8tKR\icardagt.exe

Filesize
1.3MB

MD5
2fe97a3052e847190a9775431292a3a3

SHA1
43edc451ac97365600391fa4af15476a30423ff6

SHA256
473d17e571d6947ce93103454f1e9fe27136403125152b97acb6cad5cc2a9ac7

SHA512
93ed1f9ef6fb256b53df9c6f2ce03301c0d3a0ef49c3f0604872653e4ba3fce369256f50604dd8386f543e1ea9231f5700213e683d3ea9af9e4d6c427a19117a

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Phjwnjj.lnk

Filesize
923B

MD5
e9233bf667436d2c3b7185b5a022b290

SHA1
0b6007e626a5bd1541e1bfec0f65627f73fbe2cf

SHA256
091828ff895af35bf7c059022c954cc56ace5d2a61966193f00751db3c360e7d

SHA512
9c03d88ecb6c7fe18b61109e8ee8c8ff1872831463275a64207ac923049f49a8823ce9206e4038585903b1fcfe2f4948adab3ff480b0d8dfd10f97f7ce524b8b

Download Submit
\Users\Admin\AppData\Local\tylzHc\DWWIN.EXE

Filesize
149KB

MD5
25247e3c4e7a7a73baeea6c0008952b1

SHA1
8087adb7a71a696139ddc5c5abc1a84f817ab688

SHA256
c740497a7e58f7678e25b68b03573b4136a364464ee97c02ce5e0fe00cec7050

SHA512
bc27946894e7775f772ac882740430c8b9d3f37a573e2524207f7bb32f44d4a227cb1e9a555e118d68af7f1e129abd2ac5cabbcd8bbf3551c485bae05108324b

Download Submit
memory/1212-25-0x0000000077AB0000-0x0000000077AB2000-memory.dmp

Filesize
8KB

Download
memory/1212-45-0x0000000077846000-0x0000000077847000-memory.dmp

Filesize
4KB

Download
memory/1212-14-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-13-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-12-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-11-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-10-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-9-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-8-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-24-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-26-0x0000000077AE0000-0x0000000077AE2000-memory.dmp

Filesize
8KB

Download
memory/1212-3-0x0000000077846000-0x0000000077847000-memory.dmp

Filesize
4KB

Download
memory/1212-37-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-35-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-4-0x0000000002150000-0x0000000002151000-memory.dmp

Filesize
4KB

Download
memory/1212-16-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-23-0x0000000002130000-0x0000000002137000-memory.dmp

Filesize
28KB

Download
memory/1212-15-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-7-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/1212-6-0x0000000140000000-0x00000001400A7000-memory.dmp

Filesize
668KB

Download
memory/2360-44-0x000007FEF6F90000-0x000007FEF7037000-memory.dmp

Filesize
668KB

Download
memory/2360-0-0x000007FEF6F90000-0x000007FEF7037000-memory.dmp

Filesize
668KB

Download
memory/2360-2-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2816-70-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download
memory/2816-71-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp

Filesize
672KB

Download
memory/2816-75-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp

Filesize
672KB

Download
memory/2936-58-0x000007FEF7040000-0x000007FEF70E8000-memory.dmp

Filesize
672KB

Download
memory/2936-54-0x000007FEF7040000-0x000007FEF70E8000-memory.dmp

Filesize
672KB

Download
memory/2936-53-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/3064-91-0x000007FEF6810000-0x000007FEF68B8000-memory.dmp

Filesize
672KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads