ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd | Triage

Analysis

max time kernel
137s
max time network
123s
platform
windows10_x64
resource
win10v200430
submitted
10/07/2020, 06:09

Sharing

Report Analysis Logs

General

Target

ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe
Size

152KB
MD5

e14302358a704748b2d8263e82f06b86
SHA1

872e85438a1ec7adc65edfa46920e990c560fc73
SHA256

ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd
SHA512

d0a83e8ed884cd7ba23b5dde9881fb20ad24c529e552b8df7fda3130af4d8222e1f6246d463e5683e3391fe5887f9b292b09ac78b5ce8b0d5b07a4a02b44bfdd

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 636 wrote to memory of 992	636	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	67
PID 636 wrote to memory of 992	636	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	67
PID 636 wrote to memory of 992	636	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe	67

Executes dropped EXE 1 IoCs

pid	Process
992	bdif.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\e6533cd889\bdif.exe:Zone.Identifier	ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe

C:\Users\Admin\AppData\Local\Temp\ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe
"C:\Users\Admin\AppData\Local\Temp\ec1f06186ab126a41b8232b700b6a635b8575bf86cebe9d219020cd4ddf66cfd.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:636
- \??\c:\programdata\e6533cd889\bdif.exe
  c:\programdata\e6533cd889\bdif.exe
  2⤵
  - Executes dropped EXE
  PID:992

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/636-0-0x00000000001E0000-0x00000000001F0000-memory.dmp

Filesize
64KB

Download
memory/636-1-0x00000000009F0000-0x0000000000A15000-memory.dmp

Filesize
148KB

Download
memory/992-5-0x00000000001F0000-0x0000000000200000-memory.dmp

Filesize
64KB

Download
memory/992-6-0x0000000000580000-0x00000000005A5000-memory.dmp

Filesize
148KB

Download