Analysis
-
max time kernel
136s -
max time network
138s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
18-07-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
Resource
win7
Behavioral task
behavioral2
Sample
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
Resource
win10v200430
General
-
Target
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe
-
Size
1.2MB
-
MD5
2d0e3253d3974c3ae6811b71f13ddc60
-
SHA1
0943ca90df9b9d22c66c5a1db619fb94aacf7d3f
-
SHA256
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006
-
SHA512
f384546dadc21145d4a3d777c54342949676067b3a450273f6f0ce304805eb9e2dbf7b25d8e583ddd7a4cb6d21bce1a50229517fe8028a72818821ecb0215615
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exebdif.execmd.exedescription pid process target process PID 2916 wrote to memory of 2236 2916 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 2916 wrote to memory of 2236 2916 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 2916 wrote to memory of 2236 2916 ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe bdif.exe PID 2236 wrote to memory of 640 2236 bdif.exe REG.exe PID 2236 wrote to memory of 640 2236 bdif.exe REG.exe PID 2236 wrote to memory of 640 2236 bdif.exe REG.exe PID 2236 wrote to memory of 652 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 652 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 652 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 60 2236 bdif.exe REG.exe PID 2236 wrote to memory of 60 2236 bdif.exe REG.exe PID 2236 wrote to memory of 60 2236 bdif.exe REG.exe PID 2236 wrote to memory of 612 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 612 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 612 2236 bdif.exe rundll32.exe PID 2236 wrote to memory of 3840 2236 bdif.exe cmd.exe PID 2236 wrote to memory of 3840 2236 bdif.exe cmd.exe PID 2236 wrote to memory of 3840 2236 bdif.exe cmd.exe PID 2236 wrote to memory of 3920 2236 bdif.exe REG.exe PID 2236 wrote to memory of 3920 2236 bdif.exe REG.exe PID 2236 wrote to memory of 3920 2236 bdif.exe REG.exe PID 3840 wrote to memory of 1580 3840 cmd.exe schtasks.exe PID 3840 wrote to memory of 1580 3840 cmd.exe schtasks.exe PID 3840 wrote to memory of 1580 3840 cmd.exe schtasks.exe -
Executes dropped EXE 1 IoCs
Processes:
bdif.exepid process 2236 bdif.exe -
Loads dropped DLL 2 IoCs
Processes:
rundll32.exerundll32.exepid process 652 rundll32.exe 612 rundll32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rundll32.exepid process 652 rundll32.exe 652 rundll32.exe 652 rundll32.exe 652 rundll32.exe -
Blacklisted process makes network request 2 IoCs
Processes:
rundll32.exerundll32.exeflow pid process 3 652 rundll32.exe 7 612 rundll32.exe -
NTFS ADS 1 IoCs
Processes:
ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exedescription ioc process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
REG.exeREG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe"C:\Users\Admin\AppData\Local\Temp\ad4c4a0f8c9bd64552f8ae0c4b890cfaddea2370b40d47e092f16f9322148006.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
-
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Loads dropped DLL
- Blacklisted process makes network request
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\1321ba6d1f\bdif.exe
-
C:\ProgramData\a174c1ef10e2077451f5b6dda83242a1
-
C:\Users\Admin\AppData\Local\Temp\cred.dll
-
C:\Users\Admin\AppData\Local\Temp\scr.dll
-
\??\c:\programdata\1321ba6d1f\bdif.exe
-
\Users\Admin\AppData\Local\Temp\cred.dll
-
\Users\Admin\AppData\Local\Temp\scr.dll
-
memory/60-8-0x0000000000000000-mapping.dmp
-
memory/612-9-0x0000000000000000-mapping.dmp
-
memory/640-4-0x0000000000000000-mapping.dmp
-
memory/652-5-0x0000000000000000-mapping.dmp
-
memory/1580-14-0x0000000000000000-mapping.dmp
-
memory/2236-0-0x0000000000000000-mapping.dmp
-
memory/3840-12-0x0000000000000000-mapping.dmp
-
memory/3920-13-0x0000000000000000-mapping.dmp