Dridex trojan spread via malicious RTF documents
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Two RTF documents exploit CVE-2017-0199 to download Dridex banking malware when opened.
CISA analysed two malicious RTF documents that exploit CVE-2017-0199, a Microsoft Office remote code execution vulnerability, to deliver the Dridex banking trojan. When opened, both documents display an error message to the victim while silently attempting to download a payload file named 'template.doc' from attacker-controlled domains. The malware samples were received by US-CERT and analysed as part of initial malware triage. The delivery domains (rottastics36w.net and btt5sxcx90.com) did not resolve to IP addresses at the time of analysis, suggesting the infrastructure may have been taken down or was set up as part of a targeted campaign. Both domains were registered through the same registrar with nearly identical WHOIS details, indicating coordinated campaign infrastructure.
Mentioned in this report
Detection guidance
Office Application Spawning mshta.exe
Detects Word, Excel, PowerPoint or Outlook spawning mshta.exe, the typical CVE-2017-0199 outcome where a remote HTA is fetched and executed after a malicious RTF is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning mshta.exe
id: 939eabdc-b459-5d9d-99ed-0127202269b0
status: experimental
description: Detects Microsoft Office applications spawning mshta.exe. This is the
classic CVE-2017-0199 exploitation pattern, where a malicious RTF or document pulls
a remote HTA or script and Office launches mshta to run it, as in the Dridex delivery
chain. Generalises on the parent/child relation, not on domain or file names.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133p
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
- \OUTLOOK.EXE
Image|endswith: \mshta.exe
condition: selection
falsepositives:
- Legacy line-of-business Office documents or add-ins that deliberately launch HTA
applications
level: high
author: Vorant
Office Application Spawning Script Interpreter or Download LOLBin
Detects Office applications spawning cmd, PowerShell, script hosts or common download LOLBins, as seen after a CVE-2017-0199 RTF exploit is used to fetch and run a Dridex payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Office Application Spawning Script Interpreter or Download LOLBin
id: 0295c9a9-c501-5584-b4ee-ed287fc8c91a
status: experimental
description: Detects Word, Excel or PowerPoint spawning a shell, script host or download-capable
binary. This follow-on behaviour is typical when an exploited RTF (CVE-2017-0199)
delivers a second-stage payload such as Dridex. Matches on the parent/child relation
and does not depend on campaign infrastructure.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133p
tags:
- attack.execution
- attack.t1203
- attack.command-and-control
- attack.t1105
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \WINWORD.EXE
- \EXCEL.EXE
- \POWERPNT.EXE
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \regsvr32.exe
- \rundll32.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Office macros in internal business workflows that call cmd or PowerShell
- Software deployment or document automation add-ins that launch helper scripts
level: medium
author: Vorant
2 more detections for this report are in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133p
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs