dridex | e23c41349eeefc69c4c1f27fd1571d6fc0c6b23ef1e226ae7987399748d9f993

Analysis

max time kernel
149s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19-05-2024 06:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58e75416d4ee4a278611094fcb4415b3_JaffaCakes118.dll
Size

1.2MB
MD5

58e75416d4ee4a278611094fcb4415b3
SHA1

cafe586e68798b0daf27326fef300343cb1b223b
SHA256

e23c41349eeefc69c4c1f27fd1571d6fc0c6b23ef1e226ae7987399748d9f993
SHA512

be53b9e6b09e6dbc8511accf9164ab7f58492533c5e4e916c34803dc1bb4950e8bf00ab0b29c82d1002d4882e5630f7987b15c5ab8104c500c499f643a64f22c
SSDEEP

24576:RVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:RV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1204-5-0x0000000002E00000-0x0000000002E01000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

DeviceDisplayObjectProvider.exedccw.exerdpshell.exe

pid process

2464 DeviceDisplayObjectProvider.exe
1944 dccw.exe
3004 rdpshell.exe
Loads dropped DLL 7 IoCs

Processes:

DeviceDisplayObjectProvider.exedccw.exerdpshell.exe

pid process

1204
2464 DeviceDisplayObjectProvider.exe
1204
1944 dccw.exe
1204
3004 rdpshell.exe
1204

resource	yara_rule
behavioral1/memory/1204-5-0x0000000002E00000-0x0000000002E01000-memory.dmp	dridex_stager_shellcode

pid	process
2464	DeviceDisplayObjectProvider.exe
1944	dccw.exe
3004	rdpshell.exe

pid	process
1204
2464	DeviceDisplayObjectProvider.exe
1204
1944	dccw.exe
1204
3004	rdpshell.exe
1204

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Javhf = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\QUICKL~1\\USERPI~1\\Pc1HH\\dccw.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeDeviceDisplayObjectProvider.exedccw.exerdpshell.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DeviceDisplayObjectProvider.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dccw.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpshell.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2944	rundll32.exe
2944	rundll32.exe
2944	rundll32.exe
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204
1204

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1204 wrote to memory of 2472	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2472	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2472	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2464	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2464	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2464	1204	DeviceDisplayObjectProvider.exe
PID 1204 wrote to memory of 2608	1204	dccw.exe
PID 1204 wrote to memory of 2608	1204	dccw.exe
PID 1204 wrote to memory of 2608	1204	dccw.exe
PID 1204 wrote to memory of 1944	1204	dccw.exe
PID 1204 wrote to memory of 1944	1204	dccw.exe
PID 1204 wrote to memory of 1944	1204	dccw.exe
PID 1204 wrote to memory of 3032	1204	rdpshell.exe
PID 1204 wrote to memory of 3032	1204	rdpshell.exe
PID 1204 wrote to memory of 3032	1204	rdpshell.exe
PID 1204 wrote to memory of 3004	1204	rdpshell.exe
PID 1204 wrote to memory of 3004	1204	rdpshell.exe
PID 1204 wrote to memory of 3004	1204	rdpshell.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\58e75416d4ee4a278611094fcb4415b3_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2944

C:\Windows\system32\DeviceDisplayObjectProvider.exe
C:\Windows\system32\DeviceDisplayObjectProvider.exe
1⤵
PID:2472

C:\Users\Admin\AppData\Local\WYG0v\DeviceDisplayObjectProvider.exe
C:\Users\Admin\AppData\Local\WYG0v\DeviceDisplayObjectProvider.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2464

C:\Windows\system32\dccw.exe
C:\Windows\system32\dccw.exe
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Z3tEh4iDC\dccw.exe
C:\Users\Admin\AppData\Local\Z3tEh4iDC\dccw.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1944

C:\Windows\system32\rdpshell.exe
C:\Windows\system32\rdpshell.exe
1⤵
PID:3032

C:\Users\Admin\AppData\Local\oYwKIUi\rdpshell.exe
C:\Users\Admin\AppData\Local\oYwKIUi\rdpshell.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3004

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\WYG0v\XmlLite.dll
Filesize
1.2MB

MD5
30604e0cefbec4a7bf7603256ce2874e

SHA1
968c3b47c1c01312ebd8c0ef10a1dabaa6c77299

SHA256
47581d306a0bd44fbbfaed7ebdb460e9efabef7a4401a4ceb2fcd0e673ec857f

SHA512
75eedbdaa163055bd63241b1906db6bc42d3edd6f9694930f77f21a2d9ec2f0455f065bfd23713289649fbc964a7cbe2d473f95d9cda2526920876b18238522b

Download Submit
C:\Users\Admin\AppData\Local\Z3tEh4iDC\dxva2.dll
Filesize
1.2MB

MD5
d5fdff61adad2d479d1d10162da7befe

SHA1
ef4155a17fc4bbb93307be627ae5e82c6cf94574

SHA256
899ce63dd8745f575af7dfbd3adc98180bd067fe9211e715a87c451185648117

SHA512
ec9f3366ee0000b43e9a4e6c5278522fc09c22cb409980de428a92c77df01fde67c5e90a4bcfd0da341bdd995875ee17574ef2b948934c8930cb2f711d7d45ad

Download Submit
C:\Users\Admin\AppData\Local\oYwKIUi\WINSTA.dll
Filesize
1.2MB

MD5
d6e61307b22b1f1185a971d7b07b054f

SHA1
31de13fa126e0d8fb7399b6805c25283111bc105

SHA256
521120d179fb20fd18b34f7bccd06fb8d78f054a243b09fccb9dd5a969d64cb6

SHA512
e3b4276c31fb9d4f124d587be5596a19a1b06ab6819cf8c9afd30da119d5e5acaa898777eab9ba14e0f79bbb7bd97916caf4352217741315b88e8910990ca317

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Xwtifesqpwfy.lnk
Filesize
1KB

MD5
02f7607369b5cc875c5ac603b901dd4e

SHA1
18b5bc65b8ac517ce19cb4dfbb78c7a74fbacfae

SHA256
b5c35057228a0fbc16744d6eaf526a6258948e0272e239f8a583d4ba523bdaf9

SHA512
205b558bf21e49274a5f149bf18544ee28ac39723c710c90bf06018a54bea261fdd8b987e4f05b3e31b7910e95ae37ef671076a0e4b188ceabb2dc4a74b9e02d

Download Submit
\Users\Admin\AppData\Local\WYG0v\DeviceDisplayObjectProvider.exe
Filesize
109KB

MD5
7e2eb3a4ae11190ef4c8a9b9a9123234

SHA1
72e98687a8d28614e2131c300403c2822856e865

SHA256
8481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0

SHA512
18b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf

Download Submit
\Users\Admin\AppData\Local\Z3tEh4iDC\dccw.exe
Filesize
861KB

MD5
a46cee731351eb4146db8e8a63a5c520

SHA1
8ea441e4a77642e12987ac842b36034230edd731

SHA256
283526a98a83524d21ff23f9109754c6587380b67f74cc02a9a4cd56fdb720d5

SHA512
3573c0ae21406db0c6fdda7c065fabde03235bde7f5589910822500bdfa37144f59f6e58e753e7347b899998db1dcb28050ac5a4e2c611558ae5fa405fbbc5cc

Download Submit
\Users\Admin\AppData\Local\oYwKIUi\rdpshell.exe
Filesize
292KB

MD5
a62dfcea3a58ba8fcf32f831f018fe3f

SHA1
75f7690b19866f2c2b3dd3bfdff8a1c6fa8e958b

SHA256
f8346a44f12e5b1ca6beaae5fbdf5f7f494ba204379c21d1875b03ba6da6152e

SHA512
9a3df5be95017c23ab144302d2275654e86193e2cd94957d5f72bda3cb171ec2a6da14e6631a7fd4fd053b4529f4083aa287ada57484ad0ee01a8e5b2b54c603

Download Submit
memory/1204-26-0x0000000077471000-0x0000000077472000-memory.dmp

Filesize
4KB

Download
memory/1204-24-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-15-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-14-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-13-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-12-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-11-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-9-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-27-0x0000000077600000-0x0000000077602000-memory.dmp

Filesize
8KB

Download
memory/1204-4-0x0000000077266000-0x0000000077267000-memory.dmp

Filesize
4KB

Download
memory/1204-36-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-37-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-5-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1204-25-0x0000000002AF0000-0x0000000002AF7000-memory.dmp

Filesize
28KB

Download
memory/1204-7-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-8-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-10-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/1204-64-0x0000000077266000-0x0000000077267000-memory.dmp

Filesize
4KB

Download
memory/1944-72-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/1944-78-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2464-59-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2464-54-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2464-53-0x0000000000470000-0x0000000000477000-memory.dmp

Filesize
28KB

Download
memory/2944-45-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/2944-0-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2944-1-0x0000000140000000-0x0000000140142000-memory.dmp

Filesize
1.3MB

Download
memory/3004-90-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/3004-95-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads