Analysis
- max time kernel
139s - max time network
149s - platform
windows7_x64 - resource
win7 - submitted
24/07/2020, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
91472a3a9b8c2e9c2b1db63d335373bb.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
91472a3a9b8c2e9c2b1db63d335373bb.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 91472a3a9b8c2e9c2b1db63d335373bb.exe
- Size 1.3MB
- Sample200724-a71xppv4jx
- SHA256 8bf177dcc822f7eaff3e87fec2e36a7cf7eb7dc24f6a64a3b5f2bbf27c3fef42
- MD5 91472a3a9b8c2e9c2b1db63d335373bb
- SHA1 bba8efd141794c4730c4356fd63427d7de364d7a
- SHA512 80144ab4f4a3c080fa9914f0fbb4a2cda3c342a34642ed64e937f07d801e0dc4d0aab7fab128231123782096458df5162fa0f52923c969d103d84d6a0a8389d1
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier 91472a3a9b8c2e9c2b1db63d335373bb.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2044 schtasks.exe - Loads dropped DLL 10 IoCs
pid Process 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 1516 rundll32.exe 1516 rundll32.exe 1516 rundll32.exe 1516 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe 1316 rundll32.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1256 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 24 PID 1144 wrote to memory of 1256 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 24 PID 1144 wrote to memory of 1256 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 24 PID 1144 wrote to memory of 1256 1144 91472a3a9b8c2e9c2b1db63d335373bb.exe 24 PID 1256 wrote to memory of 1052 1256 bdif.exe 27 PID 1256 wrote to memory of 1052 1256 bdif.exe 27 PID 1256 wrote to memory of 1052 1256 bdif.exe 27 PID 1256 wrote to memory of 1052 1256 bdif.exe 27 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1516 1256 bdif.exe 28 PID 1256 wrote to memory of 1800 1256 bdif.exe 30 PID 1256 wrote to memory of 1800 1256 bdif.exe 30 PID 1256 wrote to memory of 1800 1256 bdif.exe 30 PID 1256 wrote to memory of 1800 1256 bdif.exe 30 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1316 1256 bdif.exe 31 PID 1256 wrote to memory of 1952 1256 bdif.exe 35 PID 1256 wrote to memory of 1952 1256 bdif.exe 35 PID 1256 wrote to memory of 1952 1256 bdif.exe 35 PID 1256 wrote to memory of 1952 1256 bdif.exe 35 PID 1256 wrote to memory of 1924 1256 bdif.exe 36 PID 1256 wrote to memory of 1924 1256 bdif.exe 36 PID 1256 wrote to memory of 1924 1256 bdif.exe 36 PID 1256 wrote to memory of 1924 1256 bdif.exe 36 PID 1952 wrote to memory of 2044 1952 cmd.exe 39 PID 1952 wrote to memory of 2044 1952 cmd.exe 39 PID 1952 wrote to memory of 2044 1952 cmd.exe 39 PID 1952 wrote to memory of 2044 1952 cmd.exe 39 - Executes dropped EXE 1 IoCs
pid Process 1256 bdif.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1516 rundll32.exe 1516 rundll32.exe - Blacklisted process makes network request 2 IoCs
flow pid Process 5 1516 rundll32.exe 9 1316 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\91472a3a9b8c2e9c2b1db63d335373bb.exe"C:\Users\Admin\AppData\Local\Temp\91472a3a9b8c2e9c2b1db63d335373bb.exe"1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144 -
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1256 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
PID:1052
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:1516
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
PID:1800
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Loads dropped DLL
- Blacklisted process makes network request
PID:1316
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
PID:2044
-
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f3⤵PID:1924
-
-