8bf177dcc822f7eaff3e87fec2e36a7cf7eb7dc24f6a64a3b5f2bbf27c3fef42

General

Target
91472a3a9b8c2e9c2b1db63d335373bb.exe
Size 1.3MB
Sample200724-a71xppv4jx
SHA256 8bf177dcc822f7eaff3e87fec2e36a7cf7eb7dc24f6a64a3b5f2bbf27c3fef42
MD5 91472a3a9b8c2e9c2b1db63d335373bb
SHA1 bba8efd141794c4730c4356fd63427d7de364d7a
SHA512 80144ab4f4a3c080fa9914f0fbb4a2cda3c342a34642ed64e937f07d801e0dc4d0aab7fab128231123782096458df5162fa0f52923c969d103d84d6a0a8389d1
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Loads dropped DLL 3 IoCs

pid	Process
860	rundll32.exe
860	rundll32.exe
1176	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
860	rundll32.exe
860	rundll32.exe
860	rundll32.exe
860	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	860	rundll32.exe
7	1176	rundll32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2088	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	91472a3a9b8c2e9c2b1db63d335373bb.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 60 wrote to memory of 412	60	91472a3a9b8c2e9c2b1db63d335373bb.exe	67
PID 60 wrote to memory of 412	60	91472a3a9b8c2e9c2b1db63d335373bb.exe	67
PID 60 wrote to memory of 412	60	91472a3a9b8c2e9c2b1db63d335373bb.exe	67
PID 412 wrote to memory of 816	412	bdif.exe	68
PID 412 wrote to memory of 816	412	bdif.exe	68
PID 412 wrote to memory of 816	412	bdif.exe	68
PID 412 wrote to memory of 860	412	bdif.exe	69
PID 412 wrote to memory of 860	412	bdif.exe	69
PID 412 wrote to memory of 860	412	bdif.exe	69
PID 412 wrote to memory of 1136	412	bdif.exe	71
PID 412 wrote to memory of 1136	412	bdif.exe	71
PID 412 wrote to memory of 1136	412	bdif.exe	71
PID 412 wrote to memory of 1176	412	bdif.exe	72
PID 412 wrote to memory of 1176	412	bdif.exe	72
PID 412 wrote to memory of 1176	412	bdif.exe	72
PID 412 wrote to memory of 3464	412	bdif.exe	80
PID 412 wrote to memory of 3464	412	bdif.exe	80
PID 412 wrote to memory of 3464	412	bdif.exe	80
PID 412 wrote to memory of 752	412	bdif.exe	81
PID 412 wrote to memory of 752	412	bdif.exe	81
PID 412 wrote to memory of 752	412	bdif.exe	81
PID 3464 wrote to memory of 2088	3464	cmd.exe	84
PID 3464 wrote to memory of 2088	3464	cmd.exe	84
PID 3464 wrote to memory of 2088	3464	cmd.exe	84

Executes dropped EXE 1 IoCs

pid	Process
412	bdif.exe

C:\Users\Admin\AppData\Local\Temp\91472a3a9b8c2e9c2b1db63d335373bb.exe
"C:\Users\Admin\AppData\Local\Temp\91472a3a9b8c2e9c2b1db63d335373bb.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:60
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:412
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:816
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:860
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1136
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:1176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:2088
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:752