dridex | b996bd4a19e143f16d6497f87abf72874f0afba80cf5374d24b0a3522556b082

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 17:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b996bd4a19e143f16d6497f87abf72874f0afba80cf5374d24b0a3522556b082.dll
Size

1.4MB
MD5

ae929a0749157b4e066875db351711ef
SHA1

8aa55d7d9b43225ce5f67b31332f56c35459520d
SHA256

b996bd4a19e143f16d6497f87abf72874f0afba80cf5374d24b0a3522556b082
SHA512

3b5b6c85574e6bb6620cfc78c07b18101df0ef2e4e9d8f8f1affa83c0b8cfc4557a86338bed9467ddabcb6c7b98ebfd972cd1d0031ae927436629fabb8e39c34
SSDEEP

12288:nkMZ+g4TyilMqFvPIV93i/S0hzmOBt5nihfSxI/mhjEvqJ0D/eAQsroXAkH64C:nkMZ+gf4ltGd8H1fYO0q2G1Ah

Score

10^/10

dridex botnet evasion payload persistence privilege_escalation trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/1236-4-0x0000000002E60000-0x0000000002E61000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

Processes:

resource	yara_rule
behavioral1/memory/2236-0-0x0000000140000000-0x0000000140167000-memory.dmp	dridex_payload
behavioral1/memory/1236-27-0x0000000140000000-0x0000000140167000-memory.dmp	dridex_payload
behavioral1/memory/1236-40-0x0000000140000000-0x0000000140167000-memory.dmp	dridex_payload
behavioral1/memory/1236-38-0x0000000140000000-0x0000000140167000-memory.dmp	dridex_payload
behavioral1/memory/2236-47-0x0000000140000000-0x0000000140167000-memory.dmp	dridex_payload
behavioral1/memory/2872-56-0x0000000140000000-0x0000000140168000-memory.dmp	dridex_payload
behavioral1/memory/2872-61-0x0000000140000000-0x0000000140168000-memory.dmp	dridex_payload
behavioral1/memory/1600-78-0x0000000140000000-0x0000000140168000-memory.dmp	dridex_payload
behavioral1/memory/1556-90-0x0000000140000000-0x000000014019B000-memory.dmp	dridex_payload
behavioral1/memory/1556-94-0x0000000140000000-0x000000014019B000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

Processes:

msdt.exeslui.exeUtilman.exe

pid	Process
2872	msdt.exe
1600	slui.exe
1556	Utilman.exe

Loads dropped DLL 7 IoCs

Processes:

msdt.exeslui.exeUtilman.exe

pid	Process
1236
2872	msdt.exe
1236
1600	slui.exe
1236
1556	Utilman.exe
1236

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kccgsbu = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\NATIVE~1\\XrDrJa0F\\slui.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemsdt.exeslui.exeUtilman.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msdt.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Utilman.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	Process
2236	rundll32.exe
2236	rundll32.exe
2236	rundll32.exe
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236
1236

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	procid_target
PID 1236 wrote to memory of 2640	1236	31
PID 1236 wrote to memory of 2640	1236	31
PID 1236 wrote to memory of 2640	1236	31
PID 1236 wrote to memory of 2872	1236	32
PID 1236 wrote to memory of 2872	1236	32
PID 1236 wrote to memory of 2872	1236	32
PID 1236 wrote to memory of 3060	1236	33
PID 1236 wrote to memory of 3060	1236	33
PID 1236 wrote to memory of 3060	1236	33
PID 1236 wrote to memory of 1600	1236	34
PID 1236 wrote to memory of 1600	1236	34
PID 1236 wrote to memory of 1600	1236	34
PID 1236 wrote to memory of 1372	1236	35
PID 1236 wrote to memory of 1372	1236	35
PID 1236 wrote to memory of 1372	1236	35
PID 1236 wrote to memory of 1556	1236	36
PID 1236 wrote to memory of 1556	1236	36
PID 1236 wrote to memory of 1556	1236	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b996bd4a19e143f16d6497f87abf72874f0afba80cf5374d24b0a3522556b082.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2236

C:\Windows\system32\msdt.exe
C:\Windows\system32\msdt.exe
1⤵
PID:2640

C:\Users\Admin\AppData\Local\q4Y8eWXw\msdt.exe
C:\Users\Admin\AppData\Local\q4Y8eWXw\msdt.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2872

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:3060

C:\Users\Admin\AppData\Local\9rT\slui.exe
C:\Users\Admin\AppData\Local\9rT\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1600

C:\Windows\system32\Utilman.exe
C:\Windows\system32\Utilman.exe
1⤵
PID:1372

C:\Users\Admin\AppData\Local\H5Gfs\Utilman.exe
C:\Users\Admin\AppData\Local\H5Gfs\Utilman.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\9rT\WINBRAND.dll

Filesize
1.4MB

MD5
460069052ad5465660abd3930407dced

SHA1
9d89dec080c157ea7baa8a291c2f630e1fa4dfa2

SHA256
16f48bf3dd2c5d69df235261d9058492fcfe03526425ba87b4492a77038eb78a

SHA512
eb1597ffeee73b05511ad97e10333785265a8e8eb09fdb387d52ae4c6d90b31165719f8431a0d6ac6ffa50daa125bae8863656a5bcdf415b33d90f93b44a15e6

Download Submit
C:\Users\Admin\AppData\Local\H5Gfs\DUI70.dll

Filesize
1.6MB

MD5
dfc99a2b3c5d4222a5bc9edac371d935

SHA1
9a14dde411a0d0f94a3b82189d63599c31706d0b

SHA256
7399332d71f8d9a70d0f4cd2f35eb5449826d6f1e4191f67ba5d0ba5f9392858

SHA512
ace0ccb597642514e5fd3a9f0adbfc2804657c1a6317ba24ebad671ae66f872ccdb150510a1188da602c058d8fd84917ce26c109fcb587133b0afb0d91d983f4

Download Submit
C:\Users\Admin\AppData\Local\q4Y8eWXw\Secur32.dll

Filesize
1.4MB

MD5
da0238ff33e1d0c316193927f2766cf2

SHA1
dd5c0366628b93b0ccd29eb495c56753673730a0

SHA256
2c26a1512f5e69b13f997fd8ce57c9d9429ed1bf99dcaa84c446bdae0a645720

SHA512
32090e12f287a06a324921180969a4c325c8f73bf85b0f40df7d483682bdc5a11892e9e83ada08ab6d905a9a55fb2d5f5ef697163d61b656d1b134a7566eaef4

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Lcuygmmobxhxaxh.lnk

Filesize
1015B

MD5
245bdbc2144f8ef8fa3ac90b2f269c65

SHA1
a832a225c72d33f75c40010dd507c2d63766dba8

SHA256
7e455005ad1ec936ea1efa949d034d9e6bb2e805588ef86604f792e979f43e0b

SHA512
91511efae7e96e072e5260fec0a5aae67cde729282c7746ed3357fbceb2fa1bde032e4aef34228f237aa51ed3409557c2a47aa1afaedc96078abca4e9fd5a37a

Download Submit
\Users\Admin\AppData\Local\9rT\slui.exe

Filesize
341KB

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
\Users\Admin\AppData\Local\H5Gfs\Utilman.exe

Filesize
1.3MB

MD5
32c5ee55eadfc071e57851e26ac98477

SHA1
8f8d0aee344e152424143da49ce2c7badabb8f9d

SHA256
7ca90616e68bc851f14658a366d80f21ddb7a7dd8a866049e54651158784a9ea

SHA512
e0943efa81f3087c84a5909c72a436671ee8cc3cc80154901430e83ec7966aac800ad4b26f4a174a0071da617c0982ceda584686c6e2056e1a83e864aca6c975

Download Submit
\Users\Admin\AppData\Local\q4Y8eWXw\msdt.exe

Filesize
1.0MB

MD5
aecb7b09566b1f83f61d5a4b44ae9c7e

SHA1
3a4a2338c6b5ac833dc87497e04fe89c5481e289

SHA256
fbdbe7a2027cab237c4635ef71c1a93cf7afc4b79d56b63a119b7f8e3029ccf5

SHA512
6e14200262e0729ebcab2226c3eac729ab5af2a4c6f4f9c3e2950cc203387d9a0a447cf38665c724d4397353931fd10064dc067e043a3579538a6144e33e4746

Download Submit
memory/1236-27-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-38-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-14-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-13-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-12-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-11-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-10-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-9-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-7-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-6-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-4-0x0000000002E60000-0x0000000002E61000-memory.dmp

Filesize
4KB

Download
memory/1236-3-0x0000000077636000-0x0000000077637000-memory.dmp

Filesize
4KB

Download
memory/1236-29-0x00000000779D0000-0x00000000779D2000-memory.dmp

Filesize
8KB

Download
memory/1236-28-0x00000000779A0000-0x00000000779A2000-memory.dmp

Filesize
8KB

Download
memory/1236-40-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-15-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-8-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-48-0x0000000077636000-0x0000000077637000-memory.dmp

Filesize
4KB

Download
memory/1236-16-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-18-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-17-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/1236-26-0x00000000029E0000-0x00000000029E7000-memory.dmp

Filesize
28KB

Download
memory/1556-90-0x0000000140000000-0x000000014019B000-memory.dmp

Filesize
1.6MB

Download
memory/1556-94-0x0000000140000000-0x000000014019B000-memory.dmp

Filesize
1.6MB

Download
memory/1600-73-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/1600-78-0x0000000140000000-0x0000000140168000-memory.dmp

Filesize
1.4MB

Download
memory/2236-47-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/2236-0-0x0000000140000000-0x0000000140167000-memory.dmp

Filesize
1.4MB

Download
memory/2236-2-0x0000000001D80000-0x0000000001D87000-memory.dmp

Filesize
28KB

Download
memory/2872-61-0x0000000140000000-0x0000000140168000-memory.dmp

Filesize
1.4MB

Download
memory/2872-56-0x0000000140000000-0x0000000140168000-memory.dmp

Filesize
1.4MB

Download
memory/2872-58-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download