Analysis
-
max time kernel
83s -
max time network
90s -
platform
windows7_x64 -
resource
win7 -
submitted
09-07-2020 10:15
Static task
static1
Behavioral task
behavioral1
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
-
Size
152KB
-
MD5
baa2ff450f3f379590e6228f16593307
-
SHA1
9d8f255149704315531a9fb40e83337d3401446b
-
SHA256
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498
-
SHA512
086304b17ca1772a326ef35714dd293426444ac60e92d9f71923c171e59ea9d0d3ebfeb0dd917403189be366e3c58616d9a19a016e26db0f636ea057407234e0
Score
8/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exepid process 1544 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription pid process target process PID 1544 wrote to memory of 532 1544 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1544 wrote to memory of 532 1544 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1544 wrote to memory of 532 1544 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1544 wrote to memory of 532 1544 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 532 bdif.exe -
NTFS ADS 1 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription ioc process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c
-
C:\ProgramData\e6533cd889\bdif.exe
-
\ProgramData\e6533cd889\bdif.exe
-
memory/532-3-0x0000000000000000-mapping.dmp
-
memory/532-6-0x0000000000230000-0x0000000000255000-memory.dmpFilesize
148KB
-
memory/1544-0-0x0000000000030000-0x0000000000040000-memory.dmpFilesize
64KB
-
memory/1544-1-0x00000000001C0000-0x00000000001E5000-memory.dmpFilesize
148KB