dridex | 810703d8679c42fdc80712f3c968b5391fec1a07e64fb62f32ca480fa6517703

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
12-06-2024 19:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a206030ef4a2be9cb767a15d62722e09_JaffaCakes118.dll
Size

1.2MB
MD5

a206030ef4a2be9cb767a15d62722e09
SHA1

0385df49ad9737c157449e23c94077063ac761ca
SHA256

810703d8679c42fdc80712f3c968b5391fec1a07e64fb62f32ca480fa6517703
SHA512

302f3951ed1e68c72ed7a4dc2248da465b0a64c5bc6decb310cca78b182bf44bbd4531176806a1cc55dced86ff41fe232940a05dbaeb6c0f0f18e92dd50a3c70
SSDEEP

24576:KVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL81:KV8hf6STw1ZlQauvzSq01ICe6zvmG

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1200-5-0x0000000002F60000-0x0000000002F61000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

mmc.exeMagnify.exerrinstaller.exe

pid process

2704 mmc.exe
1236 Magnify.exe
2072 rrinstaller.exe
Loads dropped DLL 7 IoCs

Processes:

mmc.exeMagnify.exerrinstaller.exe

pid process

1200
2704 mmc.exe
1200
1236 Magnify.exe
1200
2072 rrinstaller.exe
1200

resource	yara_rule
behavioral1/memory/1200-5-0x0000000002F60000-0x0000000002F61000-memory.dmp	dridex_stager_shellcode

pid	process
2704	mmc.exe
1236	Magnify.exe
2072	rrinstaller.exe

pid	process
1200
2704	mmc.exe
1200
1236	Magnify.exe
1200
2072	rrinstaller.exe
1200

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-481678230-3773327859-3495911762-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mwyjnbrrs = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\HHmcwuD6\\Magnify.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exemmc.exeMagnify.exerrinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	mmc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Magnify.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rrinstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2220	rundll32.exe
2220	rundll32.exe
2220	rundll32.exe
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200
1200

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1200 wrote to memory of 1676	1200	mmc.exe
PID 1200 wrote to memory of 1676	1200	mmc.exe
PID 1200 wrote to memory of 1676	1200	mmc.exe
PID 1200 wrote to memory of 2704	1200	mmc.exe
PID 1200 wrote to memory of 2704	1200	mmc.exe
PID 1200 wrote to memory of 2704	1200	mmc.exe
PID 1200 wrote to memory of 1732	1200	Magnify.exe
PID 1200 wrote to memory of 1732	1200	Magnify.exe
PID 1200 wrote to memory of 1732	1200	Magnify.exe
PID 1200 wrote to memory of 1236	1200	Magnify.exe
PID 1200 wrote to memory of 1236	1200	Magnify.exe
PID 1200 wrote to memory of 1236	1200	Magnify.exe
PID 1200 wrote to memory of 2432	1200	rrinstaller.exe
PID 1200 wrote to memory of 2432	1200	rrinstaller.exe
PID 1200 wrote to memory of 2432	1200	rrinstaller.exe
PID 1200 wrote to memory of 2072	1200	rrinstaller.exe
PID 1200 wrote to memory of 2072	1200	rrinstaller.exe
PID 1200 wrote to memory of 2072	1200	rrinstaller.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a206030ef4a2be9cb767a15d62722e09_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe
1⤵
PID:1676

C:\Users\Admin\AppData\Local\YYae65\mmc.exe
C:\Users\Admin\AppData\Local\YYae65\mmc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2704

C:\Windows\system32\Magnify.exe
C:\Windows\system32\Magnify.exe
1⤵
PID:1732

C:\Users\Admin\AppData\Local\0Ot39\Magnify.exe
C:\Users\Admin\AppData\Local\0Ot39\Magnify.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1236

C:\Windows\system32\rrinstaller.exe
C:\Windows\system32\rrinstaller.exe
1⤵
PID:2432

C:\Users\Admin\AppData\Local\lqh\rrinstaller.exe
C:\Users\Admin\AppData\Local\lqh\rrinstaller.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2072

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\0Ot39\MAGNIFICATION.dll
Filesize
1.2MB

MD5
4e6682eb0b63d449f78c96509be7f49b

SHA1
a3b72aeac1aada83fa557f4a822713e10d7a58f6

SHA256
ffd59af648319c32b86499ef44810fed87385f01ebfb39181843c6033c6e1778

SHA512
4790d6a8a46e5b45fa77ca6e00995401b0908b69193492422d2e37e8baa0cc1c5841568940e3af5364d9430aaea4400b9086e1592d5425224019f485f7d17526

Download Submit
C:\Users\Admin\AppData\Local\lqh\MFPlat.DLL
Filesize
1.2MB

MD5
d184c8c2e4758a0ee0e6d69c43f21208

SHA1
77ef9b32641da22745a7505bda7014424711e73a

SHA256
dbb860d8373cd3b4b6d668e09f68f580ef0f61a0e075ff74ceadb42ca683982e

SHA512
2578da44f714fd532d348022127fe24cbd2e2da6aebb9340dd814d1756feb982d956656d7cfd2934906a0bdfdc4c50c272b54c7f6b75fac6c60893af5cacd071

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Pclfpjzoauil.lnk
Filesize
1KB

MD5
a79430ac9fc0889ea9c63402a760d5db

SHA1
99e8d2e48b85290d7024aa392ddc08f998c85868

SHA256
adf2bd180ad23d747b0d85ce588837b81f807ed645f10dbcbc58ded3f2b66014

SHA512
2b2e680b3b249538c3aab90d303109de5fb6c45db80e3800e2c27b75bdb5ec182215a35f1e02ee01b57b07698dffa4a67b604bd4789940862dbd2e0a71fa2aae

Download Submit
\Users\Admin\AppData\Local\0Ot39\Magnify.exe
Filesize
637KB

MD5
233b45ddf77bd45e53872881cff1839b

SHA1
d4b8cafce4664bb339859a90a9dd1506f831756d

SHA256
adfd109ec03cd57e44dbd5fd1c4d8c47f8f58f887f690ba3c92f744b670fd75a

SHA512
6fb5f730633bfb2d063e6bc8cf37a7624bdcde2bd1d0c92b6b9a557484e7acf5d3a2be354808cade751f7ac5c5fe936e765f6494ef54b4fdb2725179f0d0fe39

Download Submit
\Users\Admin\AppData\Local\YYae65\mmc.exe
Filesize
2.0MB

MD5
9fea051a9585f2a303d55745b4bf63aa

SHA1
f5dc12d658402900a2b01af2f018d113619b96b8

SHA256
b212e59e4c7fe77f6f189138d9d8b151e50eb83a35d6eadfb1e4bb0b4262c484

SHA512
beba79f0b6710929871fbdf378d3c0a41f230ac30cbfa87173f7b77c35e06425f48db42ed3b16d5d9bcb7ef0098dffcd0d2947da8fb7ec1136ea62205f1afc76

Download Submit
\Users\Admin\AppData\Local\YYae65\mmcbase.DLL
Filesize
1.2MB

MD5
bba4798c9614362c1a734ea46f619388

SHA1
7908e6ce136eb5bfe000819de1b5e072b777c9c2

SHA256
a273faee4241c46d495d442004231ebad74495d4766cf7b218d5f6365702a8ec

SHA512
0bb946c19b7b332901b6149754ca1b905445e4bc075da22ec75bbbe385803be41d5723aa035eb5dcb73d8c957addbc099bedac5209fd267496eff54f3f11c213

Download Submit
\Users\Admin\AppData\Local\lqh\rrinstaller.exe
Filesize
54KB

MD5
0d3a73b0b30252680b383532f1758649

SHA1
9f098d2037e4dd94eca6d04c37b3d4ad8b0cc931

SHA256
fc8a992b6ac311e1b1491ec3e31e273a41f7fdf3f68176321307b68489a03fbc

SHA512
a7961f4d8d0e07959d1501d721c7751b01af6704c7da5c1f31e40de5372ee6a1fce2f3e0077c8e6a1bed017e11ce4be9b0d17c04e30b222fb3f0df67b870b2d4

Download Submit
memory/1200-12-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-9-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-4-0x0000000076E06000-0x0000000076E07000-memory.dmp

Filesize
4KB

Download
memory/1200-13-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-14-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-15-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-16-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-19-0x0000000002F40000-0x0000000002F47000-memory.dmp

Filesize
28KB

Download
memory/1200-28-0x00000000771A0000-0x00000000771A2000-memory.dmp

Filesize
8KB

Download
memory/1200-27-0x0000000077011000-0x0000000077012000-memory.dmp

Filesize
4KB

Download
memory/1200-26-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-37-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-38-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-5-0x0000000002F60000-0x0000000002F61000-memory.dmp

Filesize
4KB

Download
memory/1200-11-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-10-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-72-0x0000000076E06000-0x0000000076E07000-memory.dmp

Filesize
4KB

Download
memory/1200-7-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1200-8-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/1236-79-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/1236-74-0x0000000140000000-0x0000000140144000-memory.dmp

Filesize
1.3MB

Download
memory/1236-73-0x00000000001B0000-0x00000000001B7000-memory.dmp

Filesize
28KB

Download
memory/2072-91-0x00000000003A0000-0x00000000003A7000-memory.dmp

Filesize
28KB

Download
memory/2072-97-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2220-46-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2220-1-0x0000000140000000-0x0000000140143000-memory.dmp

Filesize
1.3MB

Download
memory/2220-3-0x00000000002A0000-0x00000000002A7000-memory.dmp

Filesize
28KB

Download
memory/2704-59-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2704-54-0x0000000140000000-0x0000000140145000-memory.dmp

Filesize
1.3MB

Download
memory/2704-55-0x0000000000540000-0x0000000000547000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads