b50aded18e8af98761a91109a3027283dcd58cea80b152cdc5ce94470973473d

General

Target
d01b417a7922cda8a3211c9dd8309306.exe
Size 1.2MB
Sample200724-jmsjpmvcw2
SHA256 b50aded18e8af98761a91109a3027283dcd58cea80b152cdc5ce94470973473d
MD5 d01b417a7922cda8a3211c9dd8309306
SHA1 dbd071e86aa466fb1e70667163044bdbf14751cc
SHA512 8814948088331cf96c962e1ba88d84312b6215bb0744b6b6f81a55653e37662ce9bf41c81b67460a27d0b54de0b11232934a4a0940665182cd7c5bff3ccc7860
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3860	rundll32.exe
3860	rundll32.exe
3860	rundll32.exe
3860	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
6	3860	rundll32.exe
10	3396	rundll32.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2752	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	d01b417a7922cda8a3211c9dd8309306.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 3980	3828	d01b417a7922cda8a3211c9dd8309306.exe	67
PID 3828 wrote to memory of 3980	3828	d01b417a7922cda8a3211c9dd8309306.exe	67
PID 3828 wrote to memory of 3980	3828	d01b417a7922cda8a3211c9dd8309306.exe	67
PID 3980 wrote to memory of 3420	3980	bdif.exe	68
PID 3980 wrote to memory of 3420	3980	bdif.exe	68
PID 3980 wrote to memory of 3420	3980	bdif.exe	68
PID 3980 wrote to memory of 3860	3980	bdif.exe	69
PID 3980 wrote to memory of 3860	3980	bdif.exe	69
PID 3980 wrote to memory of 3860	3980	bdif.exe	69
PID 3980 wrote to memory of 1484	3980	bdif.exe	71
PID 3980 wrote to memory of 1484	3980	bdif.exe	71
PID 3980 wrote to memory of 1484	3980	bdif.exe	71
PID 3980 wrote to memory of 3396	3980	bdif.exe	72
PID 3980 wrote to memory of 3396	3980	bdif.exe	72
PID 3980 wrote to memory of 3396	3980	bdif.exe	72
PID 3980 wrote to memory of 3936	3980	bdif.exe	74
PID 3980 wrote to memory of 3936	3980	bdif.exe	74
PID 3980 wrote to memory of 3936	3980	bdif.exe	74
PID 3980 wrote to memory of 3852	3980	bdif.exe	75
PID 3980 wrote to memory of 3852	3980	bdif.exe	75
PID 3980 wrote to memory of 3852	3980	bdif.exe	75
PID 3936 wrote to memory of 2752	3936	cmd.exe	78
PID 3936 wrote to memory of 2752	3936	cmd.exe	78
PID 3936 wrote to memory of 2752	3936	cmd.exe	78

Executes dropped EXE 1 IoCs

pid	Process
3980	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
3860	rundll32.exe
3396	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\d01b417a7922cda8a3211c9dd8309306.exe
"C:\Users\Admin\AppData\Local\Temp\d01b417a7922cda8a3211c9dd8309306.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3828
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3980
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3420
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    - Loads dropped DLL
    PID:3860
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1484
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Blacklisted process makes network request
    - Loads dropped DLL
    PID:3396
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:2752
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3852