dridex | 46c5de5439adf19819d78a52bbdbc97c4c63e00049e019ce437c1c08ed140f33

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b20e9a37b5d638259d80111028dae1da_JaffaCakes118.dll
Size

990KB
MD5

b20e9a37b5d638259d80111028dae1da
SHA1

27499b1c4232cd3b06e687aa42bdf0b404b83583
SHA256

46c5de5439adf19819d78a52bbdbc97c4c63e00049e019ce437c1c08ed140f33
SHA512

d4f36bce2c25de4a48b8de4e32c5f938c506beeb10a6f39f1f0bfeeb30b1813ef0492b50c7e25055e0a6a72335c24ea4e1a3d6873f94ccfe69cc6695e790dd0f
SSDEEP

24576:jVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:jV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1188-5-0x0000000002490000-0x0000000002491000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

DeviceDisplayObjectProvider.exeunregmp2.exeSystemPropertiesRemote.exe

pid process

2324 DeviceDisplayObjectProvider.exe
1448 unregmp2.exe
2156 SystemPropertiesRemote.exe
Loads dropped DLL 7 IoCs

Processes:

DeviceDisplayObjectProvider.exeunregmp2.exeSystemPropertiesRemote.exe

pid process

1188
2324 DeviceDisplayObjectProvider.exe
1188
1448 unregmp2.exe
1188
2156 SystemPropertiesRemote.exe
1188

resource	yara_rule
behavioral1/memory/1188-5-0x0000000002490000-0x0000000002491000-memory.dmp	dridex_stager_shellcode

pid	process
2324	DeviceDisplayObjectProvider.exe
1448	unregmp2.exe
2156	SystemPropertiesRemote.exe

pid	process
1188
2324	DeviceDisplayObjectProvider.exe
1188
1448	unregmp2.exe
1188
2156	SystemPropertiesRemote.exe
1188

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ydmmtcuy = "C:\\Users\\Admin\\AppData\\Roaming\\MICROS~1\\INTERN~1\\UserData\\RDCPDO~1\\unregmp2.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exeDeviceDisplayObjectProvider.exeunregmp2.exeSystemPropertiesRemote.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DeviceDisplayObjectProvider.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	unregmp2.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SystemPropertiesRemote.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2004	rundll32.exe
2004	rundll32.exe
2004	rundll32.exe
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1188 wrote to memory of 2468	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 2468	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 2468	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 2324	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 2324	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 2324	1188	DeviceDisplayObjectProvider.exe
PID 1188 wrote to memory of 356	1188	unregmp2.exe
PID 1188 wrote to memory of 356	1188	unregmp2.exe
PID 1188 wrote to memory of 356	1188	unregmp2.exe
PID 1188 wrote to memory of 1448	1188	unregmp2.exe
PID 1188 wrote to memory of 1448	1188	unregmp2.exe
PID 1188 wrote to memory of 1448	1188	unregmp2.exe
PID 1188 wrote to memory of 1552	1188	SystemPropertiesRemote.exe
PID 1188 wrote to memory of 1552	1188	SystemPropertiesRemote.exe
PID 1188 wrote to memory of 1552	1188	SystemPropertiesRemote.exe
PID 1188 wrote to memory of 2156	1188	SystemPropertiesRemote.exe
PID 1188 wrote to memory of 2156	1188	SystemPropertiesRemote.exe
PID 1188 wrote to memory of 2156	1188	SystemPropertiesRemote.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b20e9a37b5d638259d80111028dae1da_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2004

C:\Windows\system32\DeviceDisplayObjectProvider.exe
C:\Windows\system32\DeviceDisplayObjectProvider.exe
1⤵
PID:2468

C:\Users\Admin\AppData\Local\Ayig4DjEg\DeviceDisplayObjectProvider.exe
C:\Users\Admin\AppData\Local\Ayig4DjEg\DeviceDisplayObjectProvider.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2324

C:\Windows\system32\unregmp2.exe
C:\Windows\system32\unregmp2.exe
1⤵
PID:356

C:\Users\Admin\AppData\Local\PAolvN\unregmp2.exe
C:\Users\Admin\AppData\Local\PAolvN\unregmp2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1448

C:\Windows\system32\SystemPropertiesRemote.exe
C:\Windows\system32\SystemPropertiesRemote.exe
1⤵
PID:1552

C:\Users\Admin\AppData\Local\gf4ZXX9\SystemPropertiesRemote.exe
C:\Users\Admin\AppData\Local\gf4ZXX9\SystemPropertiesRemote.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2156

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Ayig4DjEg\XmlLite.dll
Filesize
990KB

MD5
19cc48f7898637ab24ecde255354d075

SHA1
a074cc21d107bac7aa09215a23e63e42c8c8ad39

SHA256
2f426588d6017a3054561002dfd79b4f27d5e4e18ac7fdf6fc961e5e0232f0d7

SHA512
f447986062d79e9dc0c98f292f3a9fc0a6b5d4051af8f4cefc3700ea1f0c87575d569700b304e1dd1369a23c151f049d9236018118041f3a84025011899a55ec

Download Submit
C:\Users\Admin\AppData\Local\PAolvN\slc.dll
Filesize
991KB

MD5
48d8cf641444daf08659fb2c56d1ded5

SHA1
759bac584ace4dd04d011be79cd45d946b68e9d8

SHA256
c26e8790963d2000f9b2bceda8a3498c30d66c062d55cab0df861f3dd512f22b

SHA512
19a16ab691070ddc907d95c8980c252eb51c2941d6621355e5afedb52e5e500389824343e3ef3e92f4ee7c7b9ee3c16fac061930315255dabef131921733bd6c

Download Submit
C:\Users\Admin\AppData\Local\gf4ZXX9\SYSDM.CPL
Filesize
990KB

MD5
f564bb7dc94c734762dfc5ac24b3183b

SHA1
6fd40fe2b75cb61005d3af4c29262384ceab7102

SHA256
4bbabc5d05c13be38a2a33638b3b15e6a6070e75e5d2b26aecd836f6421bb8d1

SHA512
2487f3245631f2436e53c0947db917cabbd8a17c5f578245e1c39efa542e8e32a270dc83a7dcc080aa59141e855f1fc20c6616cb9cbd02646b746165f42a804a

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Piadwmdtymfdd.lnk
Filesize
1KB

MD5
cfd76a0ee6a8303e55d39f3a6d32e62e

SHA1
43c1203b3fc5f066aab2b3ae012798c3b15fae04

SHA256
de483df2b14eae004c4d203b96be6719d85694d93106bb0e4c727e1480d985dd

SHA512
4b0be8ae68c575b83c2577afa27fd0fce99b52b6a8c4a7d35f56a2b0c4e139bc38a943451b5c709e4a94cf3eecb22dfc2b4d2a8cc662e6367e543ea651c6658f

Download Submit
\Users\Admin\AppData\Local\Ayig4DjEg\DeviceDisplayObjectProvider.exe
Filesize
109KB

MD5
7e2eb3a4ae11190ef4c8a9b9a9123234

SHA1
72e98687a8d28614e2131c300403c2822856e865

SHA256
8481a8ec19cb656ce328c877d5817d317203ba34424a2e9d169ddce5bf2cd2b0

SHA512
18b1a0637f48929972a463d441182307725ebf1410dd461a1966bd040ac5dcced138155b7c713bfc924ea2f7b39527a084a08b44fa24c3eb9c654871f99caabf

Download Submit
\Users\Admin\AppData\Local\PAolvN\unregmp2.exe
Filesize
316KB

MD5
64b328d52dfc8cda123093e3f6e4c37c

SHA1
f68f45b21b911906f3aa982e64504e662a92e5ab

SHA256
7d6be433ba7dd4a2b8f8b79d7b87055da8daafa3e0404432d40469c39c2040e1

SHA512
e29fc068532df36f39c86b79392b5c6191de6f69b7beaba28f9ac96a26089b341b770ff29556eca14f57afd1de59a6f3726818482d6861bdd8ac556ae768df00

Download Submit
\Users\Admin\AppData\Local\gf4ZXX9\SystemPropertiesRemote.exe
Filesize
80KB

MD5
d0d7ac869aa4e179da2cc333f0440d71

SHA1
e7b9a58f5bfc1ec321f015641a60978c0c683894

SHA256
5762e1570de6ca4ff4254d03c8f6e572f3b9c065bf5c78fd5a9ea3769c33818a

SHA512
1808b10dc85f8755a0074d1ea00794b46b4254573b6862c2813a89ca171ad94f95262e8b59a8f9a596c9bd6a724f440a14a813eab93aa140e818ee97af106db7

Download Submit
memory/1188-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-24-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-25-0x00000000773F1000-0x00000000773F2000-memory.dmp

Filesize
4KB

Download
memory/1188-19-0x0000000002470000-0x0000000002477000-memory.dmp

Filesize
28KB

Download
memory/1188-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-28-0x0000000077580000-0x0000000077582000-memory.dmp

Filesize
8KB

Download
memory/1188-4-0x00000000772E6000-0x00000000772E7000-memory.dmp

Filesize
4KB

Download
memory/1188-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-5-0x0000000002490000-0x0000000002491000-memory.dmp

Filesize
4KB

Download
memory/1188-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-63-0x00000000772E6000-0x00000000772E7000-memory.dmp

Filesize
4KB

Download
memory/1448-74-0x0000000000110000-0x0000000000117000-memory.dmp

Filesize
28KB

Download
memory/1448-77-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2004-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2004-3-0x0000000000530000-0x0000000000537000-memory.dmp

Filesize
28KB

Download
memory/2004-1-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2156-94-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2324-58-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2324-55-0x00000000000F0000-0x00000000000F7000-memory.dmp

Filesize
28KB

Download
memory/2324-52-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads