Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30-06-2023 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbsc7ejpd.dll
Resource
win7-20230621-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bbsc7ejpd.dll
-
Size
497KB
-
MD5
4c40878a680989564d69aaaad6675b3d
-
SHA1
61ad964d616ed4a29fc0d3172840eced09ecc0ae
-
SHA256
3f7c187c9539e39d8556dfa534e260aa0255d682aee06e3afdcfe4c047bf6e77
-
SHA512
d997c6078564b628a8a45e3a2eb91b4dc177c892e9d3eff9026c7630bacad8344c4f63d5386e57d38381dc1002c53338001dbb4d6cd58b139b64ff2590165f17
-
SSDEEP
6144:BfI9lZeImUv/UCSZbYnwzP5SYLJfQqksIFhPYdlHT1TUnryTDjIbByQ+fRWbsK8W:FI/ZeIzkCcYEJJf4hwbBw0Dod+5M4C
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
178.128.83.165:443
128.199.59.13:8172
110.164.184.226:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 2 IoCs
Processes:
rundll32.exeflow pid process 3 920 rundll32.exe 5 920 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
rundll32.exedescription pid process target process PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe PID 2000 wrote to memory of 920 2000 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbsc7ejpd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbsc7ejpd.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/920-54-0x0000000074E80000-0x0000000074F13000-memory.dmpFilesize
588KB
-
memory/920-56-0x0000000074E80000-0x0000000074F13000-memory.dmpFilesize
588KB
-
memory/920-57-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/920-58-0x0000000074E80000-0x0000000074F13000-memory.dmpFilesize
588KB