2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4 | Triage

Analysis

max time kernel
83s
max time network
121s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 10:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe
Size

152KB
MD5

b79f3a37ad95e302618c614261703c7e
SHA1

14336f6f9b081608d903aeb126fe0b87ed241130
SHA256

2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4
SHA512

29ba3f7fbdb68a21c1e9c53747c52b43169d21c3d984fc1c43c04d49d25d1fc4dec271a8288fed6b02e96d3ebe4701616e2852dde9c112a722da810813b044ba

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 3108	720	2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe	68
PID 720 wrote to memory of 3108	720	2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe	68
PID 720 wrote to memory of 3108	720	2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe	68

Executes dropped EXE 1 IoCs

pid	Process
3108	bdif.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe

C:\Users\Admin\AppData\Local\Temp\2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe
"C:\Users\Admin\AppData\Local\Temp\2c49fa0404c9e0f1809f343b610f63ea8a7cdeb60695689dd6bfc1f9797ebdc4.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:720
- \??\c:\programdata\e6533cd889\bdif.exe
  c:\programdata\e6533cd889\bdif.exe
  2⤵
  - Executes dropped EXE
  PID:3108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/720-0-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/720-1-0x0000000000580000-0x00000000005A5000-memory.dmp

Filesize
148KB

Download
memory/3108-5-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/3108-6-0x00000000008B0000-0x00000000008D5000-memory.dmp

Filesize
148KB

Download