dridex | c567bcfe50a6894d43a4b85b302b6f76dc6376d64eb60270e92617a20c5a789c

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-12-2024 16:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_27161434e84e258ee09d7b472052965c.dll
Size

1.1MB
MD5

27161434e84e258ee09d7b472052965c
SHA1

8d3c14960b77a4796d7e1c44b48c4e06dfda645b
SHA256

c567bcfe50a6894d43a4b85b302b6f76dc6376d64eb60270e92617a20c5a789c
SHA512

53b593cf1065ce170a5b077ee5646398c74c57801785baed5fe2afe604abd3d870eee5d56cbdb7762f57a642da95c00833ce1fd1f4bb13fb97e56b48ac8c9b87
SSDEEP

12288:2dMIwS97wJs6tSKDXEabXaC+jhc1S8XXk7CZzHsZH9dq0T:wMIJxSDX3bqjhcfHk7MzH6z

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1196-4-0x00000000029F0000-0x00000000029F1000-memory.dmp	dridex_stager_shellcode

Dridex payload 7 IoCs

Detects Dridex x64 core DLL in memory.

botnet payload

resource	yara_rule
behavioral1/memory/2436-0-0x0000000140000000-0x000000014011C000-memory.dmp	dridex_payload
behavioral1/memory/1196-51-0x0000000140000000-0x000000014011C000-memory.dmp	dridex_payload
behavioral1/memory/1196-63-0x0000000140000000-0x000000014011C000-memory.dmp	dridex_payload
behavioral1/memory/1196-62-0x0000000140000000-0x000000014011C000-memory.dmp	dridex_payload
behavioral1/memory/2436-71-0x0000000140000000-0x000000014011C000-memory.dmp	dridex_payload
behavioral1/memory/2676-81-0x0000000140000000-0x000000014011D000-memory.dmp	dridex_payload
behavioral1/memory/2676-85-0x0000000140000000-0x000000014011D000-memory.dmp	dridex_payload

Executes dropped EXE 3 IoCs

pid	Process
2676	slui.exe
296	dpapimig.exe
2788	msconfig.exe

Loads dropped DLL 7 IoCs

pid	Process
1196	Process not Found
2676	slui.exe
1196	Process not Found
296	dpapimig.exe
1196	Process not Found
2788	msconfig.exe
1196	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2872745919-2748461613-2989606286-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gazvzzjnt = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\FLASHP~1\\ASSETC~1\\TNGTRLAE\\Lx\\dpapimig.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msconfig.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	slui.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dpapimig.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2436	rundll32.exe
2436	rundll32.exe
2436	rundll32.exe
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found
1196	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 2624	1196	Process not Found	31
PID 1196 wrote to memory of 2624	1196	Process not Found	31
PID 1196 wrote to memory of 2624	1196	Process not Found	31
PID 1196 wrote to memory of 2676	1196	Process not Found	32
PID 1196 wrote to memory of 2676	1196	Process not Found	32
PID 1196 wrote to memory of 2676	1196	Process not Found	32
PID 1196 wrote to memory of 1740	1196	Process not Found	33
PID 1196 wrote to memory of 1740	1196	Process not Found	33
PID 1196 wrote to memory of 1740	1196	Process not Found	33
PID 1196 wrote to memory of 296	1196	Process not Found	34
PID 1196 wrote to memory of 296	1196	Process not Found	34
PID 1196 wrote to memory of 296	1196	Process not Found	34
PID 1196 wrote to memory of 1476	1196	Process not Found	35
PID 1196 wrote to memory of 1476	1196	Process not Found	35
PID 1196 wrote to memory of 1476	1196	Process not Found	35
PID 1196 wrote to memory of 2788	1196	Process not Found	36
PID 1196 wrote to memory of 2788	1196	Process not Found	36
PID 1196 wrote to memory of 2788	1196	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_27161434e84e258ee09d7b472052965c.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Windows\system32\slui.exe
C:\Windows\system32\slui.exe
1⤵
PID:2624

C:\Users\Admin\AppData\Local\aegEgl\slui.exe
C:\Users\Admin\AppData\Local\aegEgl\slui.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2676

C:\Windows\system32\dpapimig.exe
C:\Windows\system32\dpapimig.exe
1⤵
PID:1740

C:\Users\Admin\AppData\Local\yBx\dpapimig.exe
C:\Users\Admin\AppData\Local\yBx\dpapimig.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:296

C:\Windows\system32\msconfig.exe
C:\Windows\system32\msconfig.exe
1⤵
PID:1476

C:\Users\Admin\AppData\Local\4vg50Ht\msconfig.exe
C:\Users\Admin\AppData\Local\4vg50Ht\msconfig.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\4vg50Ht\MFC42u.dll

Filesize
1.1MB

MD5
9fcf1d291f254dfe5993331fb71ba86c

SHA1
fcd000e0ab527a00dd09a8c4889a9fc5ea8ad4d3

SHA256
adc038cce48f4c7127a15462b46d39e8448e109d05bd633ad7e11ac4ed43dafc

SHA512
49f485e10a4534144a403e2a75c84e01e3e228e32dcb2697d574f311f009ff6cd44a673e73fdeafe3109807ab3f8803225a4ceb013838b283b1b506693a87b28

Download Submit
C:\Users\Admin\AppData\Local\aegEgl\slc.dll

Filesize
1.1MB

MD5
23d32286e5132601fbc0844effb35f1a

SHA1
655d892c4eac547446806b29345a5f562675f2fa

SHA256
00a99b7d77183c19613d71b4fc882d67f990873bffe9fa26f2aa5e1294ff09cc

SHA512
1409fafabf137a328cedd553d03f5ff9b96f17489f9bac0a9cc1c243bca6832d9eea603e2e1ff46733fd419b43e35c2a859a5f13dd7a3960dd3561cf3b4eb4df

Download Submit
C:\Users\Admin\AppData\Local\yBx\DUI70.dll

Filesize
1.3MB

MD5
15b774450c3d94f3525c1d7a014ce2f7

SHA1
710ef8dd71fa91d8d6185fe5b1b48d7f7a744433

SHA256
bc235000cd759e7d497c678323d8bd04856e66301dd93e044301eb8fea689c81

SHA512
cfc442ad275f3ff8c0ad430c890f39f76c6babdb9174f5c4ace867d78a9ed98beb8813cc5c7fd7796a6023343dc3bc3030e7df06d708a23182c018d1aec14961

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Wbvsyha.lnk

Filesize
1KB

MD5
b923e5d64b12211d66fe8f42e8ca84a1

SHA1
9d1d2803928700d507a28aade2c076e81e2ff234

SHA256
f106126fcad040ca5eec6ebc62d407da0d906ec6290b35c188a3982ab66b0ad1

SHA512
a73ed69e734e00c3c330c6d943a694d10e229e7eaa2d082112ec72794260372bf65794574e603358115144df857ca833f3ec3a504df114f4e8b221fffbfe581c

Download Submit
\Users\Admin\AppData\Local\4vg50Ht\msconfig.exe

Filesize
293KB

MD5
e19d102baf266f34592f7c742fbfa886

SHA1
c9c9c45b7e97bb7a180064d0a1962429f015686d

SHA256
f3c8bb430f9c33e6caf06aaebde17b7fddcc55e8bb36cec2b9379038f1fca0b1

SHA512
1b9f1880dd3c26ae790b8eead641e73264f90dc7aa2645acc530aad20ad9d247db613e1725282c85bca98c4428ac255752a4f5c9b2a97f90908b7fe4167bb283

Download Submit
\Users\Admin\AppData\Local\aegEgl\slui.exe

Filesize
341KB

MD5
c5ce5ce799387e82b7698a0ee5544a6d

SHA1
ed37fdb169bb539271c117d3e8a5f14fd8df1c0d

SHA256
34aa7ca0ea833263a6883827e161a5c218576c5ad97e0ce386fad4250676b42c

SHA512
79453b45e1f38d164ee3dbc232f774ff121d4394c22783140f5c8c722f184a69f499f2fb9621bdb28f565065b791883526e1a1d4abef9df82289613c2ce97a5c

Download Submit
\Users\Admin\AppData\Local\yBx\dpapimig.exe

Filesize
73KB

MD5
0e8b8abea4e23ddc9a70614f3f651303

SHA1
6d332ba4e7a78039f75b211845514ab35ab467b2

SHA256
66fc6b68e54b8840a38b4de980cc22aed21009afc1494a9cc68e892329f076a1

SHA512
4feded78f9b953472266693e0943030d00f82a5cc8559df60ae0479de281164155e19687afc67cba74d04bb9ad092f5c7732f2d2f9b06274ca2ae87dc2d4a6dc

Download Submit
memory/296-97-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/1196-36-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-52-0x00000000777B0000-0x00000000777B2000-memory.dmp

Filesize
8KB

Download
memory/1196-18-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-17-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-16-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-15-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-14-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-13-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-12-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-11-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-10-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-9-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-8-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-7-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-6-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-42-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-50-0x0000000002610000-0x0000000002617000-memory.dmp

Filesize
28KB

Download
memory/1196-51-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-41-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-40-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-38-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-37-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-20-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-35-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-34-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-33-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-53-0x00000000777E0000-0x00000000777E2000-memory.dmp

Filesize
8KB

Download
memory/1196-19-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-63-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-62-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-32-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-31-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-30-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-29-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-28-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-27-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-26-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-25-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-39-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-72-0x0000000077446000-0x0000000077447000-memory.dmp

Filesize
4KB

Download
memory/1196-3-0x0000000077446000-0x0000000077447000-memory.dmp

Filesize
4KB

Download
memory/1196-4-0x00000000029F0000-0x00000000029F1000-memory.dmp

Filesize
4KB

Download
memory/1196-24-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-23-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-22-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/1196-21-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/2436-71-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/2436-0-0x0000000140000000-0x000000014011C000-memory.dmp

Filesize
1.1MB

Download
memory/2436-2-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2676-85-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2676-81-0x0000000140000000-0x000000014011D000-memory.dmp

Filesize
1.1MB

Download
memory/2676-80-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/2788-114-0x0000000000100000-0x0000000000107000-memory.dmp

Filesize
28KB

Download