Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2023 12:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
bbsc7ejpd.dll
Resource
win7-20230621-en
windows7-x64
5 signatures
150 seconds
General
-
Target
bbsc7ejpd.dll
-
Size
497KB
-
MD5
4c40878a680989564d69aaaad6675b3d
-
SHA1
61ad964d616ed4a29fc0d3172840eced09ecc0ae
-
SHA256
3f7c187c9539e39d8556dfa534e260aa0255d682aee06e3afdcfe4c047bf6e77
-
SHA512
d997c6078564b628a8a45e3a2eb91b4dc177c892e9d3eff9026c7630bacad8344c4f63d5386e57d38381dc1002c53338001dbb4d6cd58b139b64ff2590165f17
-
SSDEEP
6144:BfI9lZeImUv/UCSZbYnwzP5SYLJfQqksIFhPYdlHT1TUnryTDjIbByQ+fRWbsK8W:FI/ZeIzkCcYEJJf4hwbBw0Dod+5M4C
Malware Config
Extracted
Family
dridex
Botnet
10444
C2
178.128.83.165:443
128.199.59.13:8172
110.164.184.226:6516
rc4.plain
rc4.plain
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 57 1192 rundll32.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
rundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
rundll32.exedescription pid process target process PID 4852 wrote to memory of 1192 4852 rundll32.exe rundll32.exe PID 4852 wrote to memory of 1192 4852 rundll32.exe rundll32.exe PID 4852 wrote to memory of 1192 4852 rundll32.exe rundll32.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbsc7ejpd.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\bbsc7ejpd.dll,#12⤵
- Blocklisted process makes network request
- Checks whether UAC is enabled