dridex | 3b11229202dc3871b693be51b91981a7050d395fed046f2a71895ed88ee4d6a0

Analysis

max time kernel
150s
max time network
120s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
16-06-2024 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f3a7a92eec72e39d8a9277730a077e_JaffaCakes118.dll
Size

993KB
MD5

b3f3a7a92eec72e39d8a9277730a077e
SHA1

39ec84a1246b2ae1a5f3307cd100fe59025967e5
SHA256

3b11229202dc3871b693be51b91981a7050d395fed046f2a71895ed88ee4d6a0
SHA512

475f1c60b1f75013f219761d0e9bfe5c397d2c1c61e6d9aff59f66529ff35b3134cb93708d2206a4691d4d7f67d1b484217abf8a407d1fca9d6969a7d95937dd
SSDEEP

24576:OVHchfFcSTdS1ZikTqpaIJvzSqbY/0Z2ZlECMNXkTlzvmJL8:OV8hf6STw1ZlQauvzSq01ICe6zvm

Score

10^/10

dridex botnet evasion payload persistence trojan

Malware Config

Signatures

Dridex
Dridex(known as Bugat/Cridex) is a form of malware that specializes in stealing bank credentials.
botnet dridex
Dridex Shellcode 1 IoCs
Detects Dridex Payload shellcode injected in Explorer process.
botnet payload

Processes:

resource yara_rule

behavioral1/memory/1188-5-0x0000000002570000-0x0000000002571000-memory.dmp dridex_stager_shellcode
Executes dropped EXE 3 IoCs

Processes:

PresentationSettings.exeAdapterTroubleshooter.exeEhStorAuthn.exe

pid process

2560 PresentationSettings.exe
1976 AdapterTroubleshooter.exe
3048 EhStorAuthn.exe
Loads dropped DLL 7 IoCs

Processes:

PresentationSettings.exeAdapterTroubleshooter.exeEhStorAuthn.exe

pid process

1188
2560 PresentationSettings.exe
1188
1976 AdapterTroubleshooter.exe
1188
3048 EhStorAuthn.exe
1188

resource	yara_rule
behavioral1/memory/1188-5-0x0000000002570000-0x0000000002571000-memory.dmp	dridex_stager_shellcode

pid	process
2560	PresentationSettings.exe
1976	AdapterTroubleshooter.exe
3048	EhStorAuthn.exe

pid	process
1188
2560	PresentationSettings.exe
1188
1976	AdapterTroubleshooter.exe
1188
3048	EhStorAuthn.exe
1188

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tonqjizj = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\aJMDhEG\\AdapterTroubleshooter.exe"

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

rundll32.exePresentationSettings.exeAdapterTroubleshooter.exeEhStorAuthn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	PresentationSettings.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	AdapterTroubleshooter.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	EhStorAuthn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exe

pid	process
2992	rundll32.exe
2992	rundll32.exe
2992	rundll32.exe
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188
1188

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

description	pid	target process
PID 1188 wrote to memory of 2020	1188	PresentationSettings.exe
PID 1188 wrote to memory of 2020	1188	PresentationSettings.exe
PID 1188 wrote to memory of 2020	1188	PresentationSettings.exe
PID 1188 wrote to memory of 2560	1188	PresentationSettings.exe
PID 1188 wrote to memory of 2560	1188	PresentationSettings.exe
PID 1188 wrote to memory of 2560	1188	PresentationSettings.exe
PID 1188 wrote to memory of 1944	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 1944	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 1944	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 1976	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 1976	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 1976	1188	AdapterTroubleshooter.exe
PID 1188 wrote to memory of 3024	1188	EhStorAuthn.exe
PID 1188 wrote to memory of 3024	1188	EhStorAuthn.exe
PID 1188 wrote to memory of 3024	1188	EhStorAuthn.exe
PID 1188 wrote to memory of 3048	1188	EhStorAuthn.exe
PID 1188 wrote to memory of 3048	1188	EhStorAuthn.exe
PID 1188 wrote to memory of 3048	1188	EhStorAuthn.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b3f3a7a92eec72e39d8a9277730a077e_JaffaCakes118.dll,#1
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2992

C:\Windows\system32\PresentationSettings.exe
C:\Windows\system32\PresentationSettings.exe
1⤵
PID:2020

C:\Users\Admin\AppData\Local\D0qH\PresentationSettings.exe
C:\Users\Admin\AppData\Local\D0qH\PresentationSettings.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2560

C:\Windows\system32\AdapterTroubleshooter.exe
C:\Windows\system32\AdapterTroubleshooter.exe
1⤵
PID:1944

C:\Users\Admin\AppData\Local\ehTv\AdapterTroubleshooter.exe
C:\Users\Admin\AppData\Local\ehTv\AdapterTroubleshooter.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:1976

C:\Windows\system32\EhStorAuthn.exe
C:\Windows\system32\EhStorAuthn.exe
1⤵
PID:3024

C:\Users\Admin\AppData\Local\5C54w\EhStorAuthn.exe
C:\Users\Admin\AppData\Local\5C54w\EhStorAuthn.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:3048

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\5C54w\WTSAPI32.dll
Filesize
995KB

MD5
30ad6c6497f45df4b988c15491a53f82

SHA1
9d6a77ebc586b80fdaf6756d3ba11b2463103e6a

SHA256
40a381bb7d5a8a7cc307a2b0f2463e0f49ad80d56c8bb9fa1b65d4a633d6efcc

SHA512
4285cbfe7d7b0b5cbce8f0bc3cda4dc73315f25b9533ff76343cf47b523297a23407b5040e7d732744911105d55a0e0ec5c24cf5fff6805617e32c8e8a770d37

Download Submit
C:\Users\Admin\AppData\Local\D0qH\WINMM.dll
Filesize
998KB

MD5
de3a93a16b56db39c9bffcf9de11ae05

SHA1
cc25b8c1c3bd3d5a38011dedac366f6da7014c00

SHA256
dfc95a40df9730e96f6c223ad82a6f4a6befaf227a85c0e3cf29aa811137be7f

SHA512
468782e89f55a9ff83093debd5d227eecff10170c525e29b1c7924bf440f7c6a739368437de44bbb2c61941e767b6bb8ca25dda75dfea4b1365dc329140da6f4

Download Submit
C:\Users\Admin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Mewsro.lnk
Filesize
1KB

MD5
9d5259675d3ce5509b1a6c38232e178f

SHA1
55516a610a7c6398e9251f15ad819451e7d40b9a

SHA256
7015906a31f9b0de000689e3700edd04f634bbabccb0be526c76dd07ec4afc5b

SHA512
e5ef093c2921899cfc7af146befeee03cd3d9dc4e686f340f17ae6ff2655d00b3bdab67de5ee6c23af702cce3ca4e72a3e5022338ee4c937aa935cc35fdf0953

Download Submit
\Users\Admin\AppData\Local\5C54w\EhStorAuthn.exe
Filesize
137KB

MD5
3abe95d92c80dc79707d8e168d79a994

SHA1
64b10c17f602d3f21c84954541e7092bc55bb5ab

SHA256
2159d9d5c9355521de859d1c40907fcdfef19f8cf68eda7485b89e9aa119e3ad

SHA512
70fee5e87121229bba5c5e5aaa9f028ac0546dc9d38b7a00a81b882c8f8ce4abfdc364a598976b1463cca05e9400db715f8a4478ec61b03a693bbeee18c6ae5c

Download Submit
\Users\Admin\AppData\Local\D0qH\PresentationSettings.exe
Filesize
172KB

MD5
a6f8d318f6041334889481b472000081

SHA1
b8cf08ec17b30c8811f2514246fcdff62731dd58

SHA256
208b94fd66a6ce266c3195f87029a41a0622fff47f2a5112552cb087adbb1258

SHA512
60f70fa8a19e6ea6f08f4907dd7fede3665ad3f2e013d49f6649442ea5871a967b9a53ec4d3328a06cb83b69be1b7af1bb14bf122b568bd1f8432ee1d0bfee69

Download Submit
\Users\Admin\AppData\Local\ehTv\AdapterTroubleshooter.exe
Filesize
39KB

MD5
d4170c9ff5b2f85b0ce0246033d26919

SHA1
a76118e8775e16237cf00f2fb79718be0dc84db1

SHA256
d05e010a2570cdd5a67f62c99483aeeecb6a8d5ecc523cd49b158a460c9be5da

SHA512
9c85a9ea4002bd55cf9c51e470dd1bec527ff04b5d0d6f83094a998c541416cd47c9f42c6ca7e35ffa2842877f79e3c2e989489b9bf81644c5c57bb406b89608

Download Submit
\Users\Admin\AppData\Local\ehTv\d3d9.dll
Filesize
994KB

MD5
075f2cbb187d53ee5859bbed2fd72cd3

SHA1
2a9a2d1a40ea3dfa43d975d52b02fa352ddf404f

SHA256
c630da84e1585c5a3b2bfedd1125802658a796a23250e7d966bbac63b8315db7

SHA512
ab04ec3965cb4812b750220f916f82c96881398991cdd80a3b06f978e36cfa3f46a191223f3325ab33da9d80b0027d768dcebd7072c0008d7a9d2632b47082c4

Download Submit
memory/1188-8-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-10-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-7-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-13-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-24-0x0000000002550000-0x0000000002557000-memory.dmp

Filesize
28KB

Download
memory/1188-23-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-14-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-29-0x00000000778D0000-0x00000000778D2000-memory.dmp

Filesize
8KB

Download
memory/1188-28-0x0000000077741000-0x0000000077742000-memory.dmp

Filesize
4KB

Download
memory/1188-35-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-36-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-4-0x0000000077536000-0x0000000077537000-memory.dmp

Filesize
4KB

Download
memory/1188-9-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-5-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1188-72-0x0000000077536000-0x0000000077537000-memory.dmp

Filesize
4KB

Download
memory/1188-12-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1188-11-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/1976-69-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/1976-73-0x0000000000120000-0x0000000000127000-memory.dmp

Filesize
28KB

Download
memory/1976-76-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download
memory/2560-57-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2560-52-0x0000000140000000-0x00000001400FE000-memory.dmp

Filesize
1016KB

Download
memory/2992-1-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2992-44-0x0000000140000000-0x00000001400FC000-memory.dmp

Filesize
1008KB

Download
memory/2992-3-0x00000000001A0000-0x00000000001A7000-memory.dmp

Filesize
28KB

Download
memory/3048-91-0x0000000000190000-0x0000000000197000-memory.dmp

Filesize
28KB

Download
memory/3048-94-0x0000000140000000-0x00000001400FD000-memory.dmp

Filesize
1012KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads