dridex | 4791c7c67653f43871c62ee20af9460c6d78a05572750644c3d64cb6fc5e0ace

Analysis

max time kernel
149s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 03:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b17dcef30ff24e8b5496174af6faf8db_JaffaCakes118.dll
Size

985KB
MD5

b17dcef30ff24e8b5496174af6faf8db
SHA1

b7d13894c9de90517a5fc4283116052052fb01db
SHA256

4791c7c67653f43871c62ee20af9460c6d78a05572750644c3d64cb6fc5e0ace
SHA512

f6e0601226cb4469d5d01486a6c68dd98b7e51c20912708a02482d4e5adfe479b3553c92ee6af8c92654a2e64539aaa8318346c9f1428965955bb30ca495f19f
SSDEEP

24576:2VHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:2V8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1376-5-0x0000000002970000-0x0000000002971000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

spreview.execalc.exeDevicePairingWizard.exe

pid process

2476 spreview.exe
2684 calc.exe
2436 DevicePairingWizard.exe
Loads dropped DLL 7 IoCs

Processes:

spreview.execalc.exeDevicePairingWizard.exe

pid process

1376
2476 spreview.exe
1376
2684 calc.exe
1376
2436 DevicePairingWizard.exe
1376

resource	yara_rule
behavioral1/memory/1376-5-0x0000000002970000-0x0000000002971000-memory.dmp	dridex_stager_shellcode

pid	process
2476	spreview.exe
2684	calc.exe
2436	DevicePairingWizard.exe

pid	process
1376
2476	spreview.exe
1376
2684	calc.exe
1376
2436	DevicePairingWizard.exe
1376

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\Groztcac = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\UserData\\YHUF0F~1\\calc.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exespreview.execalc.exeDevicePairingWizard.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spreview.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	calc.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DevicePairingWizard.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2220	rundll32.exe
2220	rundll32.exe
2220	rundll32.exe
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376
1376

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1376 wrote to memory of 2732	1376	spreview.exe
PID 1376 wrote to memory of 2732	1376	spreview.exe
PID 1376 wrote to memory of 2732	1376	spreview.exe
PID 1376 wrote to memory of 2476	1376	spreview.exe
PID 1376 wrote to memory of 2476	1376	spreview.exe
PID 1376 wrote to memory of 2476	1376	spreview.exe
PID 1376 wrote to memory of 2620	1376	calc.exe
PID 1376 wrote to memory of 2620	1376	calc.exe
PID 1376 wrote to memory of 2620	1376	calc.exe
PID 1376 wrote to memory of 2684	1376	calc.exe
PID 1376 wrote to memory of 2684	1376	calc.exe
PID 1376 wrote to memory of 2684	1376	calc.exe
PID 1376 wrote to memory of 2688	1376	DevicePairingWizard.exe
PID 1376 wrote to memory of 2688	1376	DevicePairingWizard.exe
PID 1376 wrote to memory of 2688	1376	DevicePairingWizard.exe
PID 1376 wrote to memory of 2436	1376	DevicePairingWizard.exe
PID 1376 wrote to memory of 2436	1376	DevicePairingWizard.exe
PID 1376 wrote to memory of 2436	1376	DevicePairingWizard.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b17dcef30ff24e8b5496174af6faf8db_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2220

C:\Windows\system32\spreview.exe
C:\Windows\system32\spreview.exe
1⤵
PID:2732

C:\Users\Admin\AppData\Local\Y1Pl0JXt\spreview.exe
C:\Users\Admin\AppData\Local\Y1Pl0JXt\spreview.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2476

C:\Windows\system32\calc.exe
C:\Windows\system32\calc.exe
1⤵
PID:2620

C:\Users\Admin\AppData\Local\RejITyDVk\calc.exe
C:\Users\Admin\AppData\Local\RejITyDVk\calc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2684

C:\Windows\system32\DevicePairingWizard.exe
C:\Windows\system32\DevicePairingWizard.exe
1⤵
PID:2688

C:\Users\Admin\AppData\Local\S0CNnDJFF\DevicePairingWizard.exe
C:\Users\Admin\AppData\Local\S0CNnDJFF\DevicePairingWizard.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2436

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\RejITyDVk\UxTheme.dll
Filesize
988KB

MD5
b7f17acc86aba0954cb970f86825473c

SHA1
9a8177e050164a1ddf19e4fff737f8f73b707c0f

SHA256
5d99f06863f203b6184c8761e9658b65f59216b28de31b39cd4b53b3abb50806

SHA512
3dc0d4ac791c7b4462525a8d672affb11b5a21ddc577253f4714f21cb22debdef47d51b59972b52f25271f4ce7d31e1719c961183b9a783eda69ec5a5397b90f

Download Submit
C:\Users\Admin\AppData\Local\S0CNnDJFF\MFC42u.dll
Filesize
1013KB

MD5
51833bb7480be2e9af6eaaf92374c18d

SHA1
110f8ac4b95b569d2456048f900fe0a39a4244e4

SHA256
5201599df60958d990eb00e0f74df3729aacada4338e63bc1c40ccfb6ef3abcf

SHA512
2b1b07bbcd46064ef2a49bcb91ab3737a302d36114dfdd22c4a6b6b853963d52a5a2a62409a5428bcb42f0bf13c337042ba2911138a6819725436af23b7d6b06

Download Submit
C:\Users\Admin\AppData\Local\Y1Pl0JXt\sqmapi.dll
Filesize
987KB

MD5
305383c7fcc4d898cf4d10425deb152b

SHA1
63bf37d0e1a9b7a99dc86bd59913897850bd81cc

SHA256
3f17a763dcf3f5807c2ee049da0ff68ac681cffd53d88dab48127b0938724d83

SHA512
42d15611948e14b87df14a193c45c4fc5fc6b22f265199180db3a5aaceca88cef51bc2227ac0474820a3c3c71c3ccd0d996bd10ae5e27a5d4fb518bc0f97e62f

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Aqrvnhd.lnk
Filesize
971B

MD5
a15ecbb1c8e7a94e49b92af0ac28c0fa

SHA1
08f81ced135f3e7f6295a01d88344c5d726d6711

SHA256
21b50f331e985eed0adbced9cd108d249cf3e901fca932879e30c52a19e66bd7

SHA512
cc4340398352fbf46a3221283061d956dd853a291780db15866e9902313acf2ff4fca89e0a2de8799d3ab680d2d19e20fa487562b0323f5ea3b32b4145b2b998

Download Submit
\Users\Admin\AppData\Local\RejITyDVk\calc.exe
Filesize
897KB

MD5
10e4a1d2132ccb5c6759f038cdb6f3c9

SHA1
42d36eeb2140441b48287b7cd30b38105986d68f

SHA256
c6a91cba00bf87cdb064c49adaac82255cbec6fdd48fd21f9b3b96abf019916b

SHA512
9bd44afb164ab3e09a784c765cd03838d2e5f696c549fc233eb5a69cada47a8e1fb62095568cb272a80da579d9d0e124b1c27cf61bb2ac8cf6e584a722d8864d

Download Submit
\Users\Admin\AppData\Local\S0CNnDJFF\DevicePairingWizard.exe
Filesize
73KB

MD5
9728725678f32e84575e0cd2d2c58e9b

SHA1
dd9505d3548f08e5198a8d6ba6bcd60b1da86d5c

SHA256
d95d3aa065a657c354244e3d9d4dc62673dc36c1bed60650fade7d128ddab544

SHA512
a5d22240450e7b659cba507f9abe7e6d861e9712ca2335ea5ceb69e3557362b00f5d02bf84c3a6fed82a09eda555866dcab43741ad9c6db96e1e302ef2363377

Download Submit
\Users\Admin\AppData\Local\Y1Pl0JXt\spreview.exe
Filesize
294KB

MD5
704cd4cac010e8e6d8de9b778ed17773

SHA1
81856abf70640f102b8b3defe2cf65669fe8e165

SHA256
4307f21d3ec3b51cba6a905a80045314ffccb4c60c11d99a3d77cc8103014208

SHA512
b380264276bad01d619a5f1f112791d6bf73dc52cdd5cca0cc1f726a6f66eefc5a78a37646792987c508f9cb5049f0eb86c71fb4c7a2d3e670c0c8623f0522ee

Download Submit
memory/1376-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-26-0x00000000773B0000-0x00000000773B2000-memory.dmp

Filesize
8KB

Download
memory/1376-25-0x0000000077221000-0x0000000077222000-memory.dmp

Filesize
4KB

Download
memory/1376-24-0x0000000002950000-0x0000000002957000-memory.dmp

Filesize
28KB

Download
memory/1376-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-37-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-4-0x0000000077016000-0x0000000077017000-memory.dmp

Filesize
4KB

Download
memory/1376-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-5-0x0000000002970000-0x0000000002971000-memory.dmp

Filesize
4KB

Download
memory/1376-73-0x0000000077016000-0x0000000077017000-memory.dmp

Filesize
4KB

Download
memory/1376-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1376-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2220-0-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2220-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2220-3-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/2436-89-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/2436-92-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2436-95-0x0000000140000000-0x0000000140103000-memory.dmp

Filesize
1.0MB

Download
memory/2476-58-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2476-55-0x0000000000170000-0x0000000000177000-memory.dmp

Filesize
28KB

Download
memory/2476-52-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2684-74-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/2684-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads