Analysis
-
max time kernel
138s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 15:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ddbbe63a86fa196d739928c165f32cac.dll
Resource
win7-20231215-en
9 signatures
150 seconds
General
-
Target
ddbbe63a86fa196d739928c165f32cac.dll
-
Size
1.7MB
-
MD5
ddbbe63a86fa196d739928c165f32cac
-
SHA1
6762a54f563ac149a70487d45c9f2b0146a0f38b
-
SHA256
2a9d2e3b8a8a847b49653f88fa4da14ef6798706f216af7a739f157dec5746ea
-
SHA512
2b5a7c5ebd2bf153101df35a4656600d419e7e889cf61ac44b503c13be6b84c986b70ea00cf1d4ac72504f9d128477e0dae2697330f1635dceb807a876993430
-
SSDEEP
12288:1VI0W/TtlPLfJCm3WIYxJ9yK5IQ9PElOlidGAWilgm5Qq0nB6wtt4AenZ1:sfP7fWsK5z9A+WGAW+V5SB6Ct4bnb
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1232-5-0x0000000002D60000-0x0000000002D61000-memory.dmp dridex_stager_shellcode -
Executes dropped EXE 3 IoCs
Processes:
wextract.exelpksetup.execalc.exepid Process 2616 wextract.exe 2796 lpksetup.exe 812 calc.exe -
Loads dropped DLL 7 IoCs
Processes:
wextract.exelpksetup.execalc.exepid Process 1232 2616 wextract.exe 1232 2796 lpksetup.exe 1232 812 calc.exe 1232 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\Bsfvntd = "C:\\Users\\Admin\\AppData\\Roaming\\MACROM~1\\FLASHP~1\\MACROM~1.COM\\support\\zAuQB\\lpksetup.exe" -
Processes:
lpksetup.execalc.exerundll32.exewextract.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lpksetup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA calc.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA rundll32.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA wextract.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
rundll32.exepid Process 2144 rundll32.exe 2144 rundll32.exe 2144 rundll32.exe 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 1232 -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
description pid Process procid_target PID 1232 wrote to memory of 2876 1232 29 PID 1232 wrote to memory of 2876 1232 29 PID 1232 wrote to memory of 2876 1232 29 PID 1232 wrote to memory of 2616 1232 28 PID 1232 wrote to memory of 2616 1232 28 PID 1232 wrote to memory of 2616 1232 28 PID 1232 wrote to memory of 2920 1232 31 PID 1232 wrote to memory of 2920 1232 31 PID 1232 wrote to memory of 2920 1232 31 PID 1232 wrote to memory of 2796 1232 30 PID 1232 wrote to memory of 2796 1232 30 PID 1232 wrote to memory of 2796 1232 30 PID 1232 wrote to memory of 2160 1232 33 PID 1232 wrote to memory of 2160 1232 33 PID 1232 wrote to memory of 2160 1232 33 PID 1232 wrote to memory of 812 1232 32 PID 1232 wrote to memory of 812 1232 32 PID 1232 wrote to memory of 812 1232 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ddbbe63a86fa196d739928c165f32cac.dll,#11⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
PID:2144
-
C:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exeC:\Users\Admin\AppData\Local\t7TB0xUB\wextract.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2616
-
C:\Windows\system32\wextract.exeC:\Windows\system32\wextract.exe1⤵PID:2876
-
C:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exeC:\Users\Admin\AppData\Local\TDeD4N7BX\lpksetup.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:2796
-
C:\Windows\system32\lpksetup.exeC:\Windows\system32\lpksetup.exe1⤵PID:2920
-
C:\Users\Admin\AppData\Local\hcA\calc.exeC:\Users\Admin\AppData\Local\hcA\calc.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
PID:812
-
C:\Windows\system32\calc.exeC:\Windows\system32\calc.exe1⤵PID:2160