dridex | 5804717ceea8c1a310409fe782bc20fededc7325e6da871a60ed5330eb11b11b

Analysis

max time kernel
150s
max time network
122s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12-01-2025 00:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5804717ceea8c1a310409fe782bc20fededc7325e6da871a60ed5330eb11b11b.dll
Size

804KB
MD5

e199895d7c54205f000375ba064ac88b
SHA1

77a94bea1030a908a1c08a19e507f29fca3de34e
SHA256

5804717ceea8c1a310409fe782bc20fededc7325e6da871a60ed5330eb11b11b
SHA512

1bc2efb59234fc071d3b549d90a69d6c5d4b80ade97fcb887fa97b6bcd0e8ab3905c9e608d355f192829e2ddb5d3d86d0a17fb28dddc34f9f07ce0f15ffeca02
SSDEEP

24576:KWyoHFMVMKkN3ZvxEhb0IsaQ4KriCo0j6IjG:tnuVMK6vx2RsIKNrjG

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex family
dridex

Dridex Shellcode 1 IoCs

Detects Dridex Payload shellcode injected in Explorer process.

botnet payload

resource	yara_rule
behavioral1/memory/1100-5-0x0000000002EB0000-0x0000000002EB1000-memory.dmp	dridex_stager_shellcode

Executes dropped EXE 3 IoCs

pid	Process
2852	mspaint.exe
2684	MpSigStub.exe
1936	eudcedit.exe

Loads dropped DLL 7 IoCs

pid	Process
1100	Process not Found
2852	mspaint.exe
1100	Process not Found
2684	MpSigStub.exe
1100	Process not Found
1936	eudcedit.exe
1100	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bvqjtr = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Libraries\\bzBJ\\MpSigStub.exe"	Process not Found

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mspaint.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MpSigStub.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	eudcedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2160	regsvr32.exe
2160	regsvr32.exe
2160	regsvr32.exe
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found
1100	Process not Found

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 3004	1100	Process not Found	31
PID 1100 wrote to memory of 3004	1100	Process not Found	31
PID 1100 wrote to memory of 3004	1100	Process not Found	31
PID 1100 wrote to memory of 2852	1100	Process not Found	32
PID 1100 wrote to memory of 2852	1100	Process not Found	32
PID 1100 wrote to memory of 2852	1100	Process not Found	32
PID 1100 wrote to memory of 2972	1100	Process not Found	33
PID 1100 wrote to memory of 2972	1100	Process not Found	33
PID 1100 wrote to memory of 2972	1100	Process not Found	33
PID 1100 wrote to memory of 2684	1100	Process not Found	34
PID 1100 wrote to memory of 2684	1100	Process not Found	34
PID 1100 wrote to memory of 2684	1100	Process not Found	34
PID 1100 wrote to memory of 2692	1100	Process not Found	35
PID 1100 wrote to memory of 2692	1100	Process not Found	35
PID 1100 wrote to memory of 2692	1100	Process not Found	35
PID 1100 wrote to memory of 1936	1100	Process not Found	36
PID 1100 wrote to memory of 1936	1100	Process not Found	36
PID 1100 wrote to memory of 1936	1100	Process not Found	36

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\5804717ceea8c1a310409fe782bc20fededc7325e6da871a60ed5330eb11b11b.dll
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2160

C:\Windows\system32\mspaint.exe
C:\Windows\system32\mspaint.exe
1⤵
PID:3004

C:\Users\Admin\AppData\Local\8IR6ZMmqG\mspaint.exe
C:\Users\Admin\AppData\Local\8IR6ZMmqG\mspaint.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2852

C:\Windows\system32\MpSigStub.exe
C:\Windows\system32\MpSigStub.exe
1⤵
PID:2972

C:\Users\Admin\AppData\Local\SGAPoVf\MpSigStub.exe
C:\Users\Admin\AppData\Local\SGAPoVf\MpSigStub.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2684

C:\Windows\system32\eudcedit.exe
C:\Windows\system32\eudcedit.exe
1⤵
PID:2692

C:\Users\Admin\AppData\Local\b7E2R\eudcedit.exe
C:\Users\Admin\AppData\Local\b7E2R\eudcedit.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\8IR6ZMmqG\VERSION.dll

Filesize
804KB

MD5
71f1ae3caf16b48f2a5f768e4d0b4cbd

SHA1
108fa453c1ec49307d91db458666f1727eb9fbce

SHA256
b4a51d28390c6893c7b8b9d79bb896ed881ae5a14da7e90f87520076c4b28cc1

SHA512
9c44a5a33be4996f956d99bf4726b0976de687d8961f4e77045b64633ae675fe054699cd2a6bc811a8811b7dbf040176b87984bdd5d3339f1a08ca35ad2503e5

Download Submit
C:\Users\Admin\AppData\Local\SGAPoVf\MpSigStub.exe

Filesize
264KB

MD5
2e6bd16aa62e5e95c7b256b10d637f8f

SHA1
350be084477b1fe581af83ca79eb58d4defe260f

SHA256
d795968b8067bb610033fa4a5b21eb2f96cef61513aba62912b8eb5c6a5ff7b3

SHA512
1f37150f6bcbe0df54bb85a5ad585824cea9332baa9be1649a95c1dfb41723de85c09d98fb2ca8261a49c2184d3bda638b84b2b7b60b97fe42a15ab1620a2542

Download Submit
C:\Users\Admin\AppData\Local\SGAPoVf\VERSION.dll

Filesize
804KB

MD5
d707b4fdb275c4f6e26d15da5a20198b

SHA1
e0cd6e60b1cf3b739de10a3e276901187ce5fc7a

SHA256
257e8ee6893f05bcde8751729610a33b5f4506501b6575394c7ef3148a8c5d78

SHA512
f3356b7de6268b80461369d4224d6d9aa742da1616125117764977190a41f9709a7d320c957d823505a7e8fdab2b0bf3ddd836cc84aaf077a76ea5570909fac7

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Phjwnjj.lnk

Filesize
1KB

MD5
6e4c5828c6b6147e9e47215457da2645

SHA1
7d11b536e77dab903e7c94cc7564ab181c3a46c9

SHA256
6bfc5a7db5bdd870adaecdfd6cdf068ca635d70c0f87353cdd02f2cf7760fe86

SHA512
3d727a1a2cc89859e54528794aa2f35273e8f7ad1d0a554775fc29d99290fc6e12a753fb681e23835ce0f3e45db6da86ec74c371414ba4d94e2dea17b0e87b78

Download Submit
\Users\Admin\AppData\Local\8IR6ZMmqG\mspaint.exe

Filesize
6.4MB

MD5
458f4590f80563eb2a0a72709bfc2bd9

SHA1
3f97dc3bd1467c710c6a8d26b97bb6cf47deb4c6

SHA256
ff923c051ae380bf30d749ebe9cf310ccab6572d84eb81b76fb1012bcbdf557f

SHA512
e34500658dbe105a704fff6988b75d13aa9931adfd585b8ce1f023c61abd573d58067ee1f43e80076729ba99c9a00c17eb8cfcfac9c3d271d76bd251ccab1681

Download Submit
\Users\Admin\AppData\Local\b7E2R\MFC42u.dll

Filesize
832KB

MD5
f5fc5fd3813c54b1039a63638e001a3f

SHA1
a9495f853e4deb0292044b0f65e4bca7e979417c

SHA256
3d73f35440a08143526f9ca294b5f6b4bc1affd05680edf0ac7bf230d63d8971

SHA512
0bb7f84dfa5f0dea157841d1124ff8b1e645b4bdc1448d1681398e584ec7fe706b32b07dbfe33c6c85754cb0c81c4e7eeed0b5f6ce1fb6a79019014e921fdbeb

Download Submit
\Users\Admin\AppData\Local\b7E2R\eudcedit.exe

Filesize
351KB

MD5
35e397d6ca8407b86d8a7972f0c90711

SHA1
6b39830003906ef82442522d22b80460c03f6082

SHA256
1f64118bdc3515e8e9fce6ad182f6d0c8a6528d638fedb4901a6152cde4c7cde

SHA512
71b0c4ac120e5841308b0c19718bdc28366b0d79c8177091328ef5421392b9ee5e4758816ffb8c0977f178e1b33ed064f64781eaf7d6952878dc8aea402f035e

Download Submit
memory/1100-11-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-14-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-23-0x0000000002E90000-0x0000000002E97000-memory.dmp

Filesize
28KB

Download
memory/1100-10-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-9-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-8-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-7-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-5-0x0000000002EB0000-0x0000000002EB1000-memory.dmp

Filesize
4KB

Download
memory/1100-4-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/1100-28-0x00000000779F0000-0x00000000779F2000-memory.dmp

Filesize
8KB

Download
memory/1100-104-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/1100-34-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-38-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-40-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-27-0x0000000077891000-0x0000000077892000-memory.dmp

Filesize
4KB

Download
memory/1100-12-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-22-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-16-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1100-15-0x0000000140000000-0x00000001400C9000-memory.dmp

Filesize
804KB

Download
memory/1936-87-0x000007FEF7130000-0x000007FEF7200000-memory.dmp

Filesize
832KB

Download
memory/1936-92-0x000007FEF7130000-0x000007FEF7200000-memory.dmp

Filesize
832KB

Download
memory/2160-13-0x000007FEF77C0000-0x000007FEF7889000-memory.dmp

Filesize
804KB

Download
memory/2160-0-0x000007FEF77C0000-0x000007FEF7889000-memory.dmp

Filesize
804KB

Download
memory/2160-3-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/2684-74-0x0000000000090000-0x0000000000097000-memory.dmp

Filesize
28KB

Download
memory/2684-75-0x000007FEF7130000-0x000007FEF71F9000-memory.dmp

Filesize
804KB

Download
memory/2684-70-0x000007FEF7130000-0x000007FEF71F9000-memory.dmp

Filesize
804KB

Download
memory/2852-58-0x000007FEF6C60000-0x000007FEF6D29000-memory.dmp

Filesize
804KB

Download
memory/2852-53-0x000007FEF6C60000-0x000007FEF6D29000-memory.dmp

Filesize
804KB

Download
memory/2852-52-0x0000000000130000-0x0000000000137000-memory.dmp

Filesize
28KB

Download