Introduction Malicious spam (malspam) pushing the Dridex banking Trojan disappeared in mid-2016, but it reappeared in January 2017 starting with a small campaign targeting UK financial institutions [1]. Since then, we've seen a handful of reporting about Dridex, but I hadn't noticed the same large-scale distribution like we saw in 2015 and 2016. At least not until recently. Less than two weeks ago on 2017-03-30, high-volume waves of malspam pushing Dridex reappeared [2]. Because my last in-depth look at Dridex for the ISC was in January 2016 [3], I think it's high time we take a more current look at this malspam. Thursday 2017-03-30 On Thursday 2017-03-30, we saw Dridex from at least two different waves of malspam [4]. In one wave of emails, attachments were zip archives containing a Visual Basic Script (.vbs) file. In the other wave, attachments were zip archives containing a Windows executable. Both attachments were double-zipped, meaning they contained a zip archive within the zip archive before you got to the malware.
On Friday 2017-04-07, I saw another wave of Dridex that I didn't have time to document. Attachments were now zip archives containing Word documents. These Word documents had macros designed to download and install Dridex. Like Dridex malspam from the previous week, these archives were double-zipped.
Monday 2017-04-10 On Monday 2017-04-10, another wave of Dridex malspam occurred. This wave of malspam tried a new tactic. Attachments from were now PDF files with embedded Word documents. These PDF files required user action to open the Word document. Then the user had to enable macros to infect a Windows computer.
I infected a Windows host by opening one of the PDF files and enabling macros for the embedded Word document. Filtering on the traffic in Wireshark, you'll see the initial HTTP request to download Dridex. Then you'll find three different IP addresses for post-infection SSL/TLS traffic associated with Dridex. The Dridex binary was encoded while it was sent over the network. The encoded binary was saved to the Windows host at C:\Users\[username]\AppData\Local\Temp\ferbys2 where it was decoded and saved in the same directory as redchip2.exe.
Indicators of Compromise (IOC) from Monday 2017-04-10 The following URLs were extracted from the Word document macros seen on Monday 2017-04-10. These URLs retrieved the encoded Dridex binary. Many of these have already been taken off-line.
Below is SSL/TLS post-infection traffic and associated certificate data from my infected Windows host on 2017-04-10: IP address 64.79.205.100 over TCP port 4743
IP address 185.25.184.214 over TCP port 4743
IP address 185.44.105.92 over TCP port 443:
Final words For now, it looks like high-volume Dridex distribution through malspam is once again a feature of our current threat landscape. But how much of a threat is it? As always, if you have a properly-configured Windows host in a well-administered environment, your risk of infection is low. But as usual, humans are the weakest link in this infection chain. If people are determined to bypass all warnings, and their systems are configured to allow it, they may very well become infected. Emails, malware samples, and the pcap associated with 2017-04-10 Dridex malspam can be found here. --- References [1] FlashPoint: Dridex Banking Trojan Returns, Leverages New UAC Bypass Method |
Brad 433 Posts ISC Handler Apr 11th 2017 |
Thread locked Subscribe |
Apr 11th 2017 5 years ago |
The German government, among others, currently (20170411 11:00 UTC) warns [1] that Dridex massively spams Germans with an unpatched 0day [2] in any version of Microsoft Office when opening RTF files, mostly disguised as Word documents.
According to my source [3] infection takes place when simply opening the document, i.e. before clicking on a button in order to enable execution of macro's. Hopefully Microsoft addresses this 0day in their security updates later today. [1] https://twitter.com/certbund/status/851724323127734272 [2] https://www.proofpoint.com/us/threat-insight/post/dridex-campaigns-millions-recipients-unpatched-microsoft-zero-day [3] https://www.heise.de/security/meldung/Dridex-Botnetz-verteilt-millionenfach-Angriffs-Mails-auf-ungepatchte-Office-Luecke-3681553.html |
Erik van Straten 129 Posts |
Quote |
Apr 11th 2017 5 years ago |
Quoting Erik van Straten:Hopefully Microsoft addresses this 0day in their security updates later today. I hope so, but wasn't the last patch-Tuesday delayed for a month? I haven't seen anything yet today, but I'll keep my fingers crossed. I also haven't seen any Dridex malspam with the 0-day exploit yet. All I've seen are the large-scale distribution Dridex that doesn't appear to be targeted for any specific region. There's more of the same today on Tuesday 2017-04-11, just like I've already posted about with PDF attachments having embedded Word documents with malicious macros. |
Brad 433 Posts ISC Handler |
Quote |
Apr 11th 2017 5 years ago |
> wasn't the last patch-Tuesday delayed for a month? I haven't seen anything yet today, but I'll keep my fingers crossed.
It's not yet 10 AM Pacific on the 2nd Tuesday in the current month. Please check again, in 62 minutes. ![]() |
Anonymous |
Quote |
Apr 11th 2017 5 years ago |
Sign Up for Free or Log In to start participating in the conversation!