f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe | Triage

Analysis

max time kernel
83s
max time network
116s
platform
windows10_x64
resource
win10
submitted
09/07/2020, 10:15

Sharing

Report Analysis Logs

General

Target

f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe
Size

152KB
MD5

25d570ff9d42df9425595dce21e00dd5
SHA1

26698d3213003a4b9a8d1cdb2ca385b049616ee6
SHA256

f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe
SHA512

2c6dd9d261fc1d9b717ead0bf2b9d8995aa977ab4fd67ed0dc7e7026306e2738fca9f283e8e0b37ececb2ec7187512c847da920a33720b9eb429d97c1a64dc18

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3264	3280	f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe	68
PID 3280 wrote to memory of 3264	3280	f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe	68
PID 3280 wrote to memory of 3264	3280	f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe	68

Executes dropped EXE 1 IoCs

pid	Process
3264	bdif.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe

C:\Users\Admin\AppData\Local\Temp\f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe
"C:\Users\Admin\AppData\Local\Temp\f0023927901cedd1868dd38f17210d3c9786f6d963b426dcd895875fbc2b26fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:3280
- \??\c:\programdata\e6533cd889\bdif.exe
  c:\programdata\e6533cd889\bdif.exe
  2⤵
  - Executes dropped EXE
  PID:3264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3264-5-0x00000000001D0000-0x00000000001E0000-memory.dmp

Filesize
64KB

Download
memory/3264-6-0x0000000000580000-0x00000000005A5000-memory.dmp

Filesize
148KB

Download
memory/3280-0-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/3280-1-0x00000000004B0000-0x00000000004D5000-memory.dmp

Filesize
148KB

Download