Analysis
-
max time kernel
144s -
max time network
90s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 07:04
Static task
static1
Behavioral task
behavioral1
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe
-
Size
152KB
-
MD5
baa2ff450f3f379590e6228f16593307
-
SHA1
9d8f255149704315531a9fb40e83337d3401446b
-
SHA256
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498
-
SHA512
086304b17ca1772a326ef35714dd293426444ac60e92d9f71923c171e59ea9d0d3ebfeb0dd917403189be366e3c58616d9a19a016e26db0f636ea057407234e0
Score
8/10
Malware Config
Signatures
-
NTFS ADS 1 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription ioc process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe -
Loads dropped DLL 1 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exepid process 1008 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exedescription pid process target process PID 1008 wrote to memory of 1428 1008 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1008 wrote to memory of 1428 1008 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1008 wrote to memory of 1428 1008 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe PID 1008 wrote to memory of 1428 1008 a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe bdif.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 1428 bdif.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"C:\Users\Admin\AppData\Local\Temp\a150964367ade095582704cb2c1fe3c79b4277ae05c9f8552a2d3bb0a0398498.exe"1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1008 -
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
PID:1428