Analysis
-
max time kernel
137s -
max time network
142s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
09-07-2020 07:44
Static task
static1
Behavioral task
behavioral1
Sample
9e0d55ea6fbd06df70af866d0fe5bb79.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9e0d55ea6fbd06df70af866d0fe5bb79.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
9e0d55ea6fbd06df70af866d0fe5bb79.exe
-
Size
152KB
-
MD5
9e0d55ea6fbd06df70af866d0fe5bb79
-
SHA1
38023f98c48e7c30dcf1b538ada8888343d1ecad
-
SHA256
486bdfa30d86eafc9fa6516ad67f6e7df39aa5fcbbe48f245e382ed38cc9adf8
-
SHA512
187e39b3a17883dcfcd621a33236c8fa8d19f1dbc03ef19cd91870e822c40798b76b640fa560b850b09432bc3ad2877a51a221d4750d075fa4fe3e64ad39b57e
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
9e0d55ea6fbd06df70af866d0fe5bb79.exedescription pid process target process PID 1652 wrote to memory of 2116 1652 9e0d55ea6fbd06df70af866d0fe5bb79.exe bdif.exe PID 1652 wrote to memory of 2116 1652 9e0d55ea6fbd06df70af866d0fe5bb79.exe bdif.exe PID 1652 wrote to memory of 2116 1652 9e0d55ea6fbd06df70af866d0fe5bb79.exe bdif.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 2116 bdif.exe -
NTFS ADS 1 IoCs
Processes:
9e0d55ea6fbd06df70af866d0fe5bb79.exedescription ioc process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 9e0d55ea6fbd06df70af866d0fe5bb79.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e0d55ea6fbd06df70af866d0fe5bb79.exe"C:\Users\Admin\AppData\Local\Temp\9e0d55ea6fbd06df70af866d0fe5bb79.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c
-
C:\ProgramData\e6533cd889\bdif.exe
-
\??\c:\programdata\e6533cd889\bdif.exe
-
memory/1652-0-0x00000000001E0000-0x00000000001F0000-memory.dmpFilesize
64KB
-
memory/1652-1-0x00000000006D0000-0x00000000006F5000-memory.dmpFilesize
148KB
-
memory/2116-2-0x0000000000000000-mapping.dmp
-
memory/2116-5-0x00000000001D0000-0x00000000001E0000-memory.dmpFilesize
64KB
-
memory/2116-6-0x00000000008C0000-0x00000000008E5000-memory.dmpFilesize
148KB