# Dridex trojan spread via malicious RTF documents

Published: 2025-07-17 · Severity: elevated
Canonical: https://vorant.io/reports/061a5c11-76bf-521c-85d0-bbad8ae294a7/dridex-trojan-spread-via-malicious-rtf-documents

> Two RTF documents exploit CVE-2017-0199 to download Dridex banking malware when opened.

CISA analysed two malicious RTF documents that exploit CVE-2017-0199, a Microsoft Office remote code execution vulnerability, to deliver the Dridex banking trojan. When opened, both documents display an error message to the victim while silently attempting to download a payload file named 'template.doc' from attacker-controlled domains. The malware samples were received by US-CERT and analysed as part of initial malware triage. The delivery domains (rottastics36w.net and btt5sxcx90.com) did not resolve to IP addresses at the time of analysis, suggesting the infrastructure may have been taken down or was set up as part of a targeted campaign. Both domains were registered through the same registrar with nearly identical WHOIS details, indicating coordinated campaign infrastructure.

## Mentioned in this report

- Vulnerabilities: CVE-2017-0199 (KEV)
- Malware: Dridex

## Detection guidance (public sample)

### Office Application Spawning mshta.exe

ATT&CK: T1203

Detects Word, Excel, PowerPoint or Outlook spawning mshta.exe, the typical CVE-2017-0199 outcome where a remote HTA is fetched and executed after a malicious RTF is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning mshta.exe
id: 939eabdc-b459-5d9d-99ed-0127202269b0
status: experimental
description: Detects Microsoft Office applications spawning mshta.exe. This is the
  classic CVE-2017-0199 exploitation pattern, where a malicious RTF or document pulls
  a remote HTA or script and Office launches mshta to run it, as in the Dridex delivery
  chain. Generalises on the parent/child relation, not on domain or file names.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133p
tags:
- attack.execution
- attack.t1203
- attack.initial-access
- attack.t1566.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    - \OUTLOOK.EXE
    Image|endswith: \mshta.exe
  condition: selection
falsepositives:
- Legacy line-of-business Office documents or add-ins that deliberately launch HTA
  applications
level: high
author: Vorant
```

### Office Application Spawning Script Interpreter or Download LOLBin

ATT&CK: T1105

Detects Office applications spawning cmd, PowerShell, script hosts or common download LOLBins, as seen after a CVE-2017-0199 RTF exploit is used to fetch and run a Dridex payload. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Office Application Spawning Script Interpreter or Download LOLBin
id: 0295c9a9-c501-5584-b4ee-ed287fc8c91a
status: experimental
description: Detects Word, Excel or PowerPoint spawning a shell, script host or download-capable
  binary. This follow-on behaviour is typical when an exploited RTF (CVE-2017-0199)
  delivers a second-stage payload such as Dridex. Matches on the parent/child relation
  and does not depend on campaign infrastructure.
references:
- https://www.cisa.gov/news-events/analysis-reports/ar20-133p
tags:
- attack.execution
- attack.t1203
- attack.command-and-control
- attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \WINWORD.EXE
    - \EXCEL.EXE
    - \POWERPNT.EXE
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \regsvr32.exe
    - \rundll32.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Office macros in internal business workflows that call cmd or PowerShell
- Software deployment or document automation add-ins that launch helper scripts
level: medium
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

2 more detections for this report are in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/analysis-reports/ar20-133p

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/061a5c11-76bf-521c-85d0-bbad8ae294a7/dridex-trojan-spread-via-malicious-rtf-documents.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup