Analysis
-
max time kernel
124s -
max time network
149s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 10:15
Static task
static1
Behavioral task
behavioral1
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
-
Size
152KB
-
MD5
baa2ff450f3f379590e6228f16593307
-
SHA1
9d8f255149704315531a9fb40e83337d3401446b
-
SHA256
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498
-
SHA512
086304b17ca1772a326ef35714dd293426444ac60e92d9f71923c171e59ea9d0d3ebfeb0dd917403189be366e3c58616d9a19a016e26db0f636ea057407234e0
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription pid process target process PID 1632 wrote to memory of 1568 1632 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1632 wrote to memory of 1568 1632 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1632 wrote to memory of 1568 1632 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 1568 bdif.exe -
NTFS ADS 1 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription ioc process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c
-
C:\ProgramData\e6533cd889\bdif.exe
-
\??\c:\programdata\e6533cd889\bdif.exe
-
memory/1568-2-0x0000000000000000-mapping.dmp
-
memory/1568-6-0x00000000008D0000-0x00000000008F5000-memory.dmpFilesize
148KB
-
memory/1632-0-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1632-1-0x00000000005C0000-0x00000000005E5000-memory.dmpFilesize
148KB