dridex | 82288b7e8104a0143320ded6d208837fdacbd5046c0a1e064297a7055b5b8f8e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-12-2024 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_1b5fc75cf7f17eb8d9d318b771073b45.dll
Size

1.4MB
MD5

1b5fc75cf7f17eb8d9d318b771073b45
SHA1

8c25138e7db9e384da66bcf7fdb1697ab9efafbc
SHA256

82288b7e8104a0143320ded6d208837fdacbd5046c0a1e064297a7055b5b8f8e
SHA512

15af9016735a827ca76c0c874641043d3782f9eb3c8c65f08cf37d007188a9af78bc32b526db164981dc6c750fbb751d58180a38636c6c94ebe1c8aa59dc512e
SSDEEP

12288:LdMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:JMIJxSDX3bqjhcfHk7MzH6z

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral2/memory/3532-4-0x0000000002880000-0x0000000002881000-memory.dmp	dridex_stager_shellcode

Dridex payload 10 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral2/memory/3996-0-0x0000000140000000-0x0000000140160000-memory.dmp	dridex_payload
behavioral2/memory/3532-61-0x0000000140000000-0x0000000140160000-memory.dmp	dridex_payload
behavioral2/memory/3532-50-0x0000000140000000-0x0000000140160000-memory.dmp	dridex_payload
behavioral2/memory/3996-66-0x0000000140000000-0x0000000140160000-memory.dmp	dridex_payload
behavioral2/memory/3784-75-0x0000000140000000-0x0000000140161000-memory.dmp	dridex_payload
behavioral2/memory/3784-73-0x0000000140000000-0x0000000140161000-memory.dmp	dridex_payload
behavioral2/memory/3784-80-0x0000000140000000-0x0000000140161000-memory.dmp	dridex_payload
behavioral2/memory/1648-98-0x0000000140000000-0x0000000140161000-memory.dmp	dridex_payload
behavioral2/memory/3596-112-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload
behavioral2/memory/3596-115-0x0000000140000000-0x0000000140162000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

pid	Process
3784	unregmp2.exe
1648	rstrui.exe
3596	mfpmp.exe

Loads dropped DLL 3 IoCs

pid	Process
3784	unregmp2.exe
1648	rstrui.exe
3596	mfpmp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Rrsphmonwo = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\Windows\\STARTM~1\\Programs\\YsDb5\\rstrui.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mfpmp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unregmp2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rstrui.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3996	rundll32.exe
3996	rundll32.exe
3996	rundll32.exe
3996	rundll32.exe
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found
3532	Process not Found

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3612	3532	Process not Found	87
PID 3532 wrote to memory of 3612	3532	Process not Found	87
PID 3532 wrote to memory of 3784	3532	Process not Found	88
PID 3532 wrote to memory of 3784	3532	Process not Found	88
PID 3532 wrote to memory of 2284	3532	Process not Found	91
PID 3532 wrote to memory of 2284	3532	Process not Found	91
PID 3532 wrote to memory of 1648	3532	Process not Found	92
PID 3532 wrote to memory of 1648	3532	Process not Found	92
PID 3532 wrote to memory of 3332	3532	Process not Found	93
PID 3532 wrote to memory of 3332	3532	Process not Found	93
PID 3532 wrote to memory of 3596	3532	Process not Found	94
PID 3532 wrote to memory of 3596	3532	Process not Found	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_1b5fc75cf7f17eb8d9d318b771073b45.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:3996

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:3612

C:\Users\Admin\AppData\Local\XrYGOFlzK\unregmp2.exe
C:\Users\Admin\AppData\Local\XrYGOFlzK\unregmp2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3784

C:\Windows\system32\rstrui.exe
C:\Windows\system32\rstrui.exe
1⤵
PID:2284

C:\Users\Admin\AppData\Local\wTG28i\rstrui.exe
C:\Users\Admin\AppData\Local\wTG28i\rstrui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1648

C:\Windows\system32\mfpmp.exe
C:\Windows\system32\mfpmp.exe
1⤵
PID:3332

C:\Users\Admin\AppData\Local\Cly\mfpmp.exe
C:\Users\Admin\AppData\Local\Cly\mfpmp.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Cly\MFPlat.DLL

Filesize
1.4MB

MD5
4e8f0cc2fdf346c14b5e61a723decec8

SHA1
ae6f65ded1de9e9b7e5ffe6cbfd4cc6fb0649fae

SHA256
798194b7006bdbb91917ae7522a307c52d66491723a62b52291c739ffae4902b

SHA512
575beacc99cda54f8ab50bfcad5ca8335378b7552d4a8fe66cda4e0a573a74cd75d15553040d51c5dc98c5d3099b39cce3dedb7dff9ee908d56e07386fd0be33

Download Submit
C:\Users\Admin\AppData\Local\Cly\mfpmp.exe

Filesize
46KB

MD5
8f8fd1988973bac0c5244431473b96a5

SHA1
ce81ea37260d7cafe27612606cf044921ad1304c

SHA256
27287ac874cef86be03aee7b6d34fdc3bd208070ed20e44621a305865fb7579e

SHA512
a91179e1561168b3b58f5ca893bce425d35f4a02aec20ac3d6fb944f5eb3c06b0a1b9d9f3fb9ea87869d65671d2b89b4ae19acf794372bdbd27f5e9756c5a8ab

Download Submit
C:\Users\Admin\AppData\Local\XrYGOFlzK\VERSION.dll

Filesize
1.4MB

MD5
867172c56ad20831e542f029abcce6e9

SHA1
f722558a58cb0df0a33fd2390b68f8f1c412de54

SHA256
2211ea3e179df93bae60e8d10979a58e84a2bc7c68b03d179792462135d3c475

SHA512
2b121f80893d67edf1d919e6a09b702cdcc2cbae598ac8834685b689485fe27ce0c3e047bfbee962cee148f4fe1711fd95df20faff412c0cb22a67cc6224be50

Download Submit
C:\Users\Admin\AppData\Local\XrYGOFlzK\unregmp2.exe

Filesize
259KB

MD5
a6fc8ce566dec7c5873cb9d02d7b874e

SHA1
a30040967f75df85a1e3927bdce159b102011a61

SHA256
21f41fea24dddc8a32f902af7b0387a53a745013429d8fd3f5fa6916eadc839d

SHA512
f83e17dd305eb1bc24cca1f197e2440f9b501eafb9c9d44ede7c88b1520030a87d059bdcb8eadeac1eaedabcbc4fe50206821965d73f0f6671e27edd55c01cbc

Download Submit
C:\Users\Admin\AppData\Local\wTG28i\SPP.dll

Filesize
1.4MB

MD5
23d93bdcc67bfae1d367281ae62caa8a

SHA1
c0fd964d75cadb40359bc080a3541c496e68f8ff

SHA256
5b0aaa24fcce54b3d57be830989c98647e58176f15269cd61bae80ab6e676b75

SHA512
efa02f88eae1c7b93fdd575fa311fb7079f3332f4f3aa1524289be69462cb758b768501b9d9c7baaa29016ffc013e43183029b9ad5457681749b43fb85c1ffb0

Download Submit
C:\Users\Admin\AppData\Local\wTG28i\rstrui.exe

Filesize
268KB

MD5
4cad10846e93e85790865d5c0ab6ffd9

SHA1
8a223f4bab28afa4c7ed630f29325563c5dcda1a

SHA256
9ddcfcaf2ebc810cc2e593446681bc4ccbad39756b1712cf045db8dee6310b4b

SHA512
c0db44de0d35a70277f8621a318c5099378da675376e47545cfbfa7412e70a870fd05c92e0d6523ea2e0139d54d9eeaed14973762341fa3154406ae36f4ce7c6

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Yxuzhivmkyvewy.lnk

Filesize
1KB

MD5
6dd2757c1fde6010b5c6be0ead6e4b95

SHA1
4508b4d04f4b2a0bd33e8e1e315209603ff7bb73

SHA256
be0a85767764d236035d15c32cb70cec9ac75cdaeb01e77524a5a31e871a1aad

SHA512
25b78fc3bf77d294371836066b453ecedaf782be815dd5b7041c72a876113a43b23cb96b66397041d521c299189bca125e673251099a8be3aed109229439f62d

Download Submit
memory/1648-98-0x0000000140000000-0x0000000140161000-memory.dmp

Filesize
1.4MB

Download
memory/1648-94-0x000001A2FE180000-0x000001A2FE187000-memory.dmp

Filesize
28KB

Download
memory/1648-91-0x0000000140000000-0x0000000140161000-memory.dmp

Filesize
1.4MB

Download
memory/3532-35-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-14-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-39-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-38-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-36-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-37-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-9-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-34-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-33-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-32-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-31-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-28-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-30-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-29-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-27-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-26-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-25-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-24-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-51-0x00007FFD0B340000-0x00007FFD0B350000-memory.dmp

Filesize
64KB

Download
memory/3532-21-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-18-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-12-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-20-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-19-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-17-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-16-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-15-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-40-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-10-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-11-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-23-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-22-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-13-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-8-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-7-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-6-0x00007FFD0A7AA000-0x00007FFD0A7AB000-memory.dmp

Filesize
4KB

Download
memory/3532-4-0x0000000002880000-0x0000000002881000-memory.dmp

Filesize
4KB

Download
memory/3532-41-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-50-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-42-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-64-0x0000000000A20000-0x0000000000A27000-memory.dmp

Filesize
28KB

Download
memory/3532-61-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3532-52-0x00007FFD0B330000-0x00007FFD0B340000-memory.dmp

Filesize
64KB

Download
memory/3596-109-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3596-110-0x0000024A73AE0000-0x0000024A73AE7000-memory.dmp

Filesize
28KB

Download
memory/3596-112-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3596-115-0x0000000140000000-0x0000000140162000-memory.dmp

Filesize
1.4MB

Download
memory/3784-80-0x0000000140000000-0x0000000140161000-memory.dmp

Filesize
1.4MB

Download
memory/3784-73-0x0000000140000000-0x0000000140161000-memory.dmp

Filesize
1.4MB

Download
memory/3784-76-0x000002946E820000-0x000002946E827000-memory.dmp

Filesize
28KB

Download
memory/3784-75-0x0000000140000000-0x0000000140161000-memory.dmp

Filesize
1.4MB

Download
memory/3996-66-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3996-0-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3996-2-0x0000000140000000-0x0000000140160000-memory.dmp

Filesize
1.4MB

Download
memory/3996-3-0x000001D78D770000-0x000001D78D777000-memory.dmp

Filesize
28KB

Download