ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd | Triage

Analysis

max time kernel
140s
max time network
146s
platform
windows7_x64
resource
win7
submitted
10/07/2020, 06:09

Sharing

Report Analysis Logs

General

Target

ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe
Size

152KB
MD5

e14302358a704748b2d8263e82f06b86
SHA1

872e85438a1ec7adc65edfa46920e990c560fc73
SHA256

ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd
SHA512

d0a83e8ed884cd7ba23b5dde9881fb20ad24c529e552b8df7fda3130af4d8222e1f6246d463e5683e3391fe5887f9b292b09ac78b5ce8b0d5b07a4a02b44bfdd

Score

8^/10

Malware Config

Signatures

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 1848	1768	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	25
PID 1768 wrote to memory of 1848	1768	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	25
PID 1768 wrote to memory of 1848	1768	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	25
PID 1768 wrote to memory of 1848	1768	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	25

Executes dropped EXE 1 IoCs

pid	Process
1848	bdif.exe

C:\Users\Admin\AppData\Local\Temp\ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe
"C:\Users\Admin\AppData\Local\Temp\ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe"
1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768
- \??\c:\programdata\e6533cd889\bdif.exe
  c:\programdata\e6533cd889\bdif.exe
  2⤵
  - Executes dropped EXE
  PID:1848

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1768-0-0x00000000001C0000-0x00000000001D0000-memory.dmp

Filesize
64KB

Download
memory/1768-1-0x0000000000280000-0x00000000002A5000-memory.dmp

Filesize
148KB

Download
memory/1848-5-0x0000000000030000-0x0000000000040000-memory.dmp

Filesize
64KB

Download
memory/1848-6-0x00000000002D0000-0x00000000002F5000-memory.dmp

Filesize
148KB

Download