Analysis
-
max time kernel
140s -
max time network
139s -
platform
windows7_x64 -
resource
win7 -
submitted
18-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
Resource
win7
Behavioral task
behavioral2
Sample
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
Resource
win10v200430
General
-
Target
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
-
Size
1.2MB
-
MD5
2d0e3253d3974c3ae6811b71f13ddc60
-
SHA1
0943ca90df9b9d22c66c5a1db619fb94aacf7d3f
-
SHA256
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006
-
SHA512
f384546dadc21145d4a3d777c54342949676067b3a450273f6f0ce304805eb9e2dbf7b25d8e583ddd7a4cb6d21bce1a50229517fe8028a72818821ecb0215615
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exebdif.execmd.exedescription pid process target process PID 1100 wrote to memory of 1228 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 1100 wrote to memory of 1228 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 1100 wrote to memory of 1228 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 1100 wrote to memory of 1228 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 1228 wrote to memory of 1052 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1052 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1052 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1052 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1508 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1800 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1800 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1800 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1800 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1316 1228 bdif.exe rundll32.exe PID 1228 wrote to memory of 1940 1228 bdif.exe cmd.exe PID 1228 wrote to memory of 1940 1228 bdif.exe cmd.exe PID 1228 wrote to memory of 1940 1228 bdif.exe cmd.exe PID 1228 wrote to memory of 1940 1228 bdif.exe cmd.exe PID 1228 wrote to memory of 1928 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1928 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1928 1228 bdif.exe REG.exe PID 1228 wrote to memory of 1928 1228 bdif.exe REG.exe PID 1940 wrote to memory of 2044 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 2044 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 2044 1940 cmd.exe schtasks.exe PID 1940 wrote to memory of 2044 1940 cmd.exe schtasks.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 1228 bdif.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
rundll32.exepid process 1508 rundll32.exe 1508 rundll32.exe -
Blacklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 5 1508 rundll32.exe 9 1316 rundll32.exe -
NTFS ADS 1 IoCs
Processes:
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exedescription ioc process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
REG.exeREG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Loads dropped DLL 10 IoCs
Processes:
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exerundll32.exerundll32.exepid process 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe 1100 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe 1508 rundll32.exe 1508 rundll32.exe 1508 rundll32.exe 1508 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe"C:\Users\Admin\AppData\Local\Temp\ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Loads dropped DLL
-
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Blacklisted process makes network request
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1321ba6d1f\bdif.exe
-
C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
-
C:\Users\Admin\AppData\Local\Temp\cred.dll
-
C:\Users\Admin\AppData\Local\Temp\scr.dll
-
\ProgramData\1321ba6d1f\bdif.exe
-
\ProgramData\1321ba6d1f\bdif.exe
-
\Users\Admin\AppData\Local\Temp\cred.dll
-
\Users\Admin\AppData\Local\Temp\cred.dll
-
\Users\Admin\AppData\Local\Temp\cred.dll
-
\Users\Admin\AppData\Local\Temp\cred.dll
-
\Users\Admin\AppData\Local\Temp\scr.dll
-
\Users\Admin\AppData\Local\Temp\scr.dll
-
\Users\Admin\AppData\Local\Temp\scr.dll
-
\Users\Admin\AppData\Local\Temp\scr.dll
-
memory/1052-5-0x0000000000000000-mapping.dmp
-
memory/1228-2-0x0000000000000000-mapping.dmp
-
memory/1316-13-0x0000000000000000-mapping.dmp
-
memory/1508-6-0x0000000000000000-mapping.dmp
-
memory/1800-12-0x0000000000000000-mapping.dmp
-
memory/1928-20-0x0000000000000000-mapping.dmp
-
memory/1940-19-0x0000000000000000-mapping.dmp
-
memory/2044-21-0x0000000000000000-mapping.dmp