Analysis
-
max time kernel
142s -
max time network
111s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09-07-2020 10:15
Static task
static1
Behavioral task
behavioral1
Sample
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
Resource
win7v200430
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
Resource
win10
0 signatures
0 seconds
General
-
Target
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
-
Size
152KB
-
MD5
54ce74d7da4e96422bbe999c75f4e8f4
-
SHA1
64ef5b1d805794ab861cd6126d70021a8712b279
-
SHA256
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f
-
SHA512
c3b9e610d56537e969a772406955dd4bf2ef1c8ec7ac0a771c7f6ffcf6f0be0a99025a5f2109689c56f3c9a55c0cbfecf45f15b3e91e0570a9e24eb8956aaa2e
Score
8/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
Processes:
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exepid process 888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exedescription pid process target process PID 888 wrote to memory of 1380 888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe bdif.exe PID 888 wrote to memory of 1380 888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe bdif.exe PID 888 wrote to memory of 1380 888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe bdif.exe PID 888 wrote to memory of 1380 888 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe bdif.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 1380 bdif.exe -
NTFS ADS 1 IoCs
Processes:
8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exedescription ioc process File created \??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier 8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe"C:\Users\Admin\AppData\Local\Temp\8d3e06384cbad1d3a2d2a1ff747527f67141fbddb9ba9a223d9e69f31afd1d5f.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
\??\c:\programdata\e6533cd889\bdif.exec:\programdata\e6533cd889\bdif.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\83bb50ad72ec066ba3b2332b06c6d86c
-
C:\ProgramData\e6533cd889\bdif.exe
-
\ProgramData\e6533cd889\bdif.exe
-
memory/888-0-0x0000000000230000-0x0000000000240000-memory.dmpFilesize
64KB
-
memory/888-1-0x0000000000240000-0x0000000000265000-memory.dmpFilesize
148KB
-
memory/1380-3-0x0000000000000000-mapping.dmp
-
memory/1380-5-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/1380-6-0x00000000001E0000-0x0000000000205000-memory.dmpFilesize
148KB