Analysis
- max time kernel
139s - max time network
147s - platform
windows7_x64 - resource
win7 - submitted
24/07/2020, 09:01
Static task
static1
Behavioral task
behavioral1
Sample
93a818193f2a4ff9a94c7817e0bb40ac.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
93a818193f2a4ff9a94c7817e0bb40ac.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 93a818193f2a4ff9a94c7817e0bb40ac.exe
- Size 1.2MB
- Sample200724-rvx3jc9mc2
- SHA256 439a9e99c2a031e2bf670822dd9514c07c59f1dbe0b334b88a5a75378dfe1b81
- MD5 93a818193f2a4ff9a94c7817e0bb40ac
- SHA1 be1fd753bb18460a64afcbd10c2cb1fcbc077f9b
- SHA512 ae6f4bbee4a5b0290032d8ccd640d3263b39887c3f39fb44e48316fd22f6074151cff379da48871b669d5e5cb71fb80263ee40d2ab571e83d57886ad184611b4
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1400 schtasks.exe - Loads dropped DLL 10 IoCs
pid Process 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1760 rundll32.exe 1892 rundll32.exe 1892 rundll32.exe 1892 rundll32.exe 1892 rundll32.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1492 wrote to memory of 1552 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 24 PID 1492 wrote to memory of 1552 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 24 PID 1492 wrote to memory of 1552 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 24 PID 1492 wrote to memory of 1552 1492 93a818193f2a4ff9a94c7817e0bb40ac.exe 24 PID 1552 wrote to memory of 1780 1552 bdif.exe 27 PID 1552 wrote to memory of 1780 1552 bdif.exe 27 PID 1552 wrote to memory of 1780 1552 bdif.exe 27 PID 1552 wrote to memory of 1780 1552 bdif.exe 27 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1760 1552 bdif.exe 29 PID 1552 wrote to memory of 1896 1552 bdif.exe 30 PID 1552 wrote to memory of 1896 1552 bdif.exe 30 PID 1552 wrote to memory of 1896 1552 bdif.exe 30 PID 1552 wrote to memory of 1896 1552 bdif.exe 30 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 1892 1552 bdif.exe 31 PID 1552 wrote to memory of 2024 1552 bdif.exe 35 PID 1552 wrote to memory of 2024 1552 bdif.exe 35 PID 1552 wrote to memory of 2024 1552 bdif.exe 35 PID 1552 wrote to memory of 2024 1552 bdif.exe 35 PID 1552 wrote to memory of 2012 1552 bdif.exe 36 PID 1552 wrote to memory of 2012 1552 bdif.exe 36 PID 1552 wrote to memory of 2012 1552 bdif.exe 36 PID 1552 wrote to memory of 2012 1552 bdif.exe 36 PID 2024 wrote to memory of 1400 2024 cmd.exe 39 PID 2024 wrote to memory of 1400 2024 cmd.exe 39 PID 2024 wrote to memory of 1400 2024 cmd.exe 39 PID 2024 wrote to memory of 1400 2024 cmd.exe 39 - Executes dropped EXE 1 IoCs
pid Process 1552 bdif.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1760 rundll32.exe 1760 rundll32.exe - Blacklisted process makes network request 2 IoCs
flow pid Process 6 1760 rundll32.exe 10 1892 rundll32.exe - NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier 93a818193f2a4ff9a94c7817e0bb40ac.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\93a818193f2a4ff9a94c7817e0bb40ac.exe"C:\Users\Admin\AppData\Local\Temp\93a818193f2a4ff9a94c7817e0bb40ac.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:1492 -
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1552 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
PID:1780
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
PID:1760
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
PID:1896
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Loads dropped DLL
- Blacklisted process makes network request
PID:1892
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
PID:1400
-
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f3⤵PID:2012
-
-