dridex | 3b3f6912efd246ea622818440eeaa38e8a01710721713270b85d912c9fc03e66

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
13-06-2024 23:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a71c52fe86f8d9c2bbf951c11532e60c_JaffaCakes118.dll
Size

1.2MB
MD5

a71c52fe86f8d9c2bbf951c11532e60c
SHA1

bb1d4e0c6b530f6d991a304ecb9a53a466899329
SHA256

3b3f6912efd246ea622818440eeaa38e8a01710721713270b85d912c9fc03e66
SHA512

62f1a60da642ce2cc99a5953cb1969d9d64d351bd81772cc15c1bb3e233db92fa2b986d0701cb8a49c2d2383a7cb417cfa15731fc6889294bcbac8c914077aa4
SSDEEP

24576:UuYfg4LhHr4NFXKJO1aUiDBvZ2+ITHmpclO9NCt:M9cKrUqZWLAcU

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1196-5-0x0000000002710000-0x0000000002711000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

rdpclip.execonsent.exerekeywiz.exe

pid process

2488 rdpclip.exe
2468 consent.exe
1964 rekeywiz.exe
Loads dropped DLL 7 IoCs

Processes:

rdpclip.execonsent.exerekeywiz.exe

pid process

1196
2488 rdpclip.exe
1196
2468 consent.exe
1196
1964 rekeywiz.exe
1196

resource	yara_rule
behavioral1/memory/1196-5-0x0000000002710000-0x0000000002711000-memory.dmp	dridex_stager_shellcode

pid	process
2488	rdpclip.exe
2468	consent.exe
1964	rekeywiz.exe

pid	process
1196
2488	rdpclip.exe
1196
2468	consent.exe
1196
1964	rekeywiz.exe
1196

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gqwtkfbnxxlbs = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\ESZ\\consent.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exerdpclip.execonsent.exerekeywiz.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rdpclip.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	consent.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rekeywiz.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2084	rundll32.exe
2084	rundll32.exe
2084	rundll32.exe
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196
1196

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1196 wrote to memory of 2536	1196	rdpclip.exe
PID 1196 wrote to memory of 2536	1196	rdpclip.exe
PID 1196 wrote to memory of 2536	1196	rdpclip.exe
PID 1196 wrote to memory of 2488	1196	rdpclip.exe
PID 1196 wrote to memory of 2488	1196	rdpclip.exe
PID 1196 wrote to memory of 2488	1196	rdpclip.exe
PID 1196 wrote to memory of 332	1196	consent.exe
PID 1196 wrote to memory of 332	1196	consent.exe
PID 1196 wrote to memory of 332	1196	consent.exe
PID 1196 wrote to memory of 2468	1196	consent.exe
PID 1196 wrote to memory of 2468	1196	consent.exe
PID 1196 wrote to memory of 2468	1196	consent.exe
PID 1196 wrote to memory of 1716	1196	rekeywiz.exe
PID 1196 wrote to memory of 1716	1196	rekeywiz.exe
PID 1196 wrote to memory of 1716	1196	rekeywiz.exe
PID 1196 wrote to memory of 1964	1196	rekeywiz.exe
PID 1196 wrote to memory of 1964	1196	rekeywiz.exe
PID 1196 wrote to memory of 1964	1196	rekeywiz.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\a71c52fe86f8d9c2bbf951c11532e60c_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2084

C:\Windows\system32\rdpclip.exe
C:\Windows\system32\rdpclip.exe
1⤵
PID:2536

C:\Users\Admin\AppData\Local\6JXv\rdpclip.exe
C:\Users\Admin\AppData\Local\6JXv\rdpclip.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2488

C:\Windows\system32\consent.exe
C:\Windows\system32\consent.exe
1⤵
PID:332

C:\Users\Admin\AppData\Local\mQKJ0A\consent.exe
C:\Users\Admin\AppData\Local\mQKJ0A\consent.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2468

C:\Windows\system32\rekeywiz.exe
C:\Windows\system32\rekeywiz.exe
1⤵
PID:1716

C:\Users\Admin\AppData\Local\01Cj\rekeywiz.exe
C:\Users\Admin\AppData\Local\01Cj\rekeywiz.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1964

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\01Cj\rekeywiz.exe
Filesize
67KB

MD5
767c75767b00ccfd41a547bb7b2adfff

SHA1
91890853a5476def402910e6507417d400c0d3cb

SHA256
bd70e504871a2ac1c883d19b87970c8d1b8b251c784bf777ba77ed764f5f2395

SHA512
f096043452a1aa213a5e4d62638de3ee4b0b3ad3d12b7ee0372d8c79e00e2e13b4fd0ebc4206bbdb5124bed292dd5b30ef1641288046ef835f89c332985154f9

Download Submit
C:\Users\Admin\AppData\Local\01Cj\slc.dll
Filesize
1.2MB

MD5
bf83bfcb8c2e5ef712bcb82504d92665

SHA1
05bb01a2c75c68393bc63446430ce46e0b790b8a

SHA256
4c5242fb4f891d648eb1f76ed8c43c0e42090fddada91ae9ac555a6769cef7a9

SHA512
6c99a9936ce23a73025b28a8924f6244107a0b130c294c72a7addce2b757359ed27c5b99c2dd982b2f03c75aee4a299c767814a153957c92a38badffa508413a

Download Submit
C:\Users\Admin\AppData\Local\6JXv\WTSAPI32.dll
Filesize
1.2MB

MD5
6937b16aa06e096811c1a00a841b7e41

SHA1
02ee376980a1e3e5d14685cff86ae27a391ccae5

SHA256
8933eb55399d3e7c1212ba0184af638ed7bedc51e2d8a717f0cffc0d17f55451

SHA512
7e63e887dc85837a5f22b705d904b9c99c3d016a521fc8de97f128d64a14cbdc1ae7c79a3b10a83ce723ee3d08e965273355038dee18968f28e22621aa7f7b87

Download Submit
C:\Users\Admin\AppData\Local\mQKJ0A\WINSTA.dll
Filesize
1.2MB

MD5
240e0fd05f7c2fff050aceeb272dd2fa

SHA1
9c48853b6e4f5039b32ae2352689c3d2e650f411

SHA256
6eb7a225af8cfea7b518007de44f9a94fb7d96a4dc7c092e973166991a122f35

SHA512
91ddbef5c3be41121de13b099d0d39d5bf0eef7a0ca323766d2c925d46b6af62e36cbb01a6f3ccd706023edd31e53d4cb6b24351a5e82c1d066644c92aa3a6bb

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Egmip.lnk
Filesize
1KB

MD5
a17b58b708a1aee670f0bc6d096aabe0

SHA1
f0ef831a89c718210251c3eb3b463aa2d0cb44f0

SHA256
7d71ec140ed8bb3c09edda86b2ed379878cba5a238430fb0f5cbacd196f1404a

SHA512
23ad5c125cedf4e0cfea1323bf976d6320f06be0e645b6e5e8c1c11719ee4ef9332c6bbf7207addcbbea351e8774d209a21328f3c36019e3fc0d7cd577d394b1

Download Submit
\Users\Admin\AppData\Local\6JXv\rdpclip.exe
Filesize
206KB

MD5
25d284eb2f12254c001afe9a82575a81

SHA1
cf131801fdd5ec92278f9e0ae62050e31c6670a5

SHA256
837e0d864c474956c0d9d4e7ae5f884007f19b7f420db9afcf0d266aefa6608b

SHA512
7b4f208fa1681a0a139577ebc974e7acfc85e3c906a674e111223783460585eb989cb6b38f215d79f89e747a0e9224d90e1aa43e091d2042edb8bac7b27b968b

Download Submit
\Users\Admin\AppData\Local\mQKJ0A\consent.exe
Filesize
109KB

MD5
0b5511674394666e9d221f8681b2c2e6

SHA1
6e4e720dfc424a12383f0b8194e4477e3bc346dc

SHA256
ccad775decb5aec98118b381eeccc6d540928035cfb955abcb4ad3ded390b79b

SHA512
00d28a00fd3ceaeae42ba6882ffb42aa4cc8b92b07a10f28df8e1931df4b806aebdcfab1976bf8d5ce0b98c64da19d4ee06a6315734fa5f885ecd1f6e1ff16a7

Download Submit
memory/1196-17-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-28-0x00000000026F0000-0x00000000026F7000-memory.dmp

Filesize
28KB

Download
memory/1196-18-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-4-0x0000000077A36000-0x0000000077A37000-memory.dmp

Filesize
4KB

Download
memory/1196-16-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-15-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-14-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-13-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-12-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-11-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-10-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-9-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-8-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-5-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1196-27-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-41-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-40-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-19-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-31-0x0000000077B41000-0x0000000077B42000-memory.dmp

Filesize
4KB

Download
memory/1196-7-0x0000000140000000-0x0000000140134000-memory.dmp

Filesize
1.2MB

Download
memory/1196-32-0x0000000077CD0000-0x0000000077CD2000-memory.dmp

Filesize
8KB

Download
memory/1196-67-0x0000000077A36000-0x0000000077A37000-memory.dmp

Filesize
4KB

Download
memory/1964-93-0x0000000001C10000-0x0000000001C17000-memory.dmp

Filesize
28KB

Download
memory/1964-95-0x000007FEF6680000-0x000007FEF67B5000-memory.dmp

Filesize
1.2MB

Download
memory/1964-99-0x000007FEF6680000-0x000007FEF67B5000-memory.dmp

Filesize
1.2MB

Download
memory/2084-33-0x000007FEF67D0000-0x000007FEF6904000-memory.dmp

Filesize
1.2MB

Download
memory/2084-3-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2084-0-0x000007FEF67D0000-0x000007FEF6904000-memory.dmp

Filesize
1.2MB

Download
memory/2468-75-0x0000000000370000-0x0000000000377000-memory.dmp

Filesize
28KB

Download
memory/2468-76-0x000007FEF67D0000-0x000007FEF6906000-memory.dmp

Filesize
1.2MB

Download
memory/2468-81-0x000007FEF67D0000-0x000007FEF6906000-memory.dmp

Filesize
1.2MB

Download
memory/2488-62-0x000007FEF7260000-0x000007FEF7395000-memory.dmp

Filesize
1.2MB

Download
memory/2488-57-0x000007FEF7260000-0x000007FEF7395000-memory.dmp

Filesize
1.2MB

Download
memory/2488-56-0x0000000000080000-0x0000000000087000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads