439a9e99c2a031e2bf670822dd9514c07c59f1dbe0b334b88a5a75378dfe1b81

Analysis

max time kernel
138s
max time network
146s
platform
windows10_x64
resource
win10v200722
submitted
24/07/2020, 09:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
93a818193f2a4ff9a94c7817e0bb40ac.exe
Size 1.2MB
Sample200724-rvx3jc9mc2
SHA256 439a9e99c2a031e2bf670822dd9514c07c59f1dbe0b334b88a5a75378dfe1b81
MD5 93a818193f2a4ff9a94c7817e0bb40ac
SHA1 be1fd753bb18460a64afcbd10c2cb1fcbc077f9b
SHA512 ae6f4bbee4a5b0290032d8ccd640d3263b39887c3f39fb44e48316fd22f6074151cff379da48871b669d5e5cb71fb80263ee40d2ab571e83d57886ad184611b4
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
3992	bdif.exe
1484	ldr.exe
1856	client32.exe

Loads dropped DLL 9 IoCs

pid	Process
844	rundll32.exe
1112	rundll32.exe
1856	client32.exe
1856	client32.exe
1856	client32.exe
1856	client32.exe
1856	client32.exe
1856	client32.exe
1856	client32.exe

JavaScript code in executable 2 IoCs

resource	yara_rule
behavioral2/files/0x000100000001ad4a-19.dat	js
behavioral2/files/0x000100000001ad4a-20.dat	js

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autorun.ini.lnk	ldr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3564	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	93a818193f2a4ff9a94c7817e0bb40ac.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2096 wrote to memory of 3992	2096	93a818193f2a4ff9a94c7817e0bb40ac.exe	66
PID 2096 wrote to memory of 3992	2096	93a818193f2a4ff9a94c7817e0bb40ac.exe	66
PID 2096 wrote to memory of 3992	2096	93a818193f2a4ff9a94c7817e0bb40ac.exe	66
PID 3992 wrote to memory of 796	3992	bdif.exe	67
PID 3992 wrote to memory of 796	3992	bdif.exe	67
PID 3992 wrote to memory of 796	3992	bdif.exe	67
PID 3992 wrote to memory of 844	3992	bdif.exe	68
PID 3992 wrote to memory of 844	3992	bdif.exe	68
PID 3992 wrote to memory of 844	3992	bdif.exe	68
PID 3992 wrote to memory of 1040	3992	bdif.exe	70
PID 3992 wrote to memory of 1040	3992	bdif.exe	70
PID 3992 wrote to memory of 1040	3992	bdif.exe	70
PID 3992 wrote to memory of 1112	3992	bdif.exe	71
PID 3992 wrote to memory of 1112	3992	bdif.exe	71
PID 3992 wrote to memory of 1112	3992	bdif.exe	71
PID 3992 wrote to memory of 1484	3992	bdif.exe	73
PID 3992 wrote to memory of 1484	3992	bdif.exe	73
PID 3992 wrote to memory of 1484	3992	bdif.exe	73
PID 1484 wrote to memory of 1856	1484	ldr.exe	74
PID 1484 wrote to memory of 1856	1484	ldr.exe	74
PID 1484 wrote to memory of 1856	1484	ldr.exe	74
PID 3992 wrote to memory of 392	3992	bdif.exe	85
PID 3992 wrote to memory of 392	3992	bdif.exe	85
PID 3992 wrote to memory of 392	3992	bdif.exe	85
PID 3992 wrote to memory of 2884	3992	bdif.exe	86
PID 3992 wrote to memory of 2884	3992	bdif.exe	86
PID 3992 wrote to memory of 2884	3992	bdif.exe	86
PID 392 wrote to memory of 3564	392	cmd.exe	89
PID 392 wrote to memory of 3564	392	cmd.exe	89
PID 392 wrote to memory of 3564	392	cmd.exe	89

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe
844	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	844	rundll32.exe
7	1112	rundll32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1856	client32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1856	client32.exe

C:\Users\Admin\AppData\Local\Temp\93a818193f2a4ff9a94c7817e0bb40ac.exe
"C:\Users\Admin\AppData\Local\Temp\93a818193f2a4ff9a94c7817e0bb40ac.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:2096
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:796
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:844
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1040
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:1112
- - C:\ProgramData\1321ba6d1f\ldr.exe
    C:\ProgramData\1321ba6d1f\ldr.exe
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe
      "C:\Users\Admin\AppData\Roaming\CodeIntegrity\WinSupport\client32.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of FindShellTrayWindow
      Suspicious use of AdjustPrivilegeToken
      PID:1856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:3564
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:2884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads