8bb7089cb231edd0bd09d9611b41f6f23e12e5110dee1c97a1346ef57198c41f

General

Target

983909e9e67f6f54976187f51d865ddd.exe
Size

830KB
MD5

983909e9e67f6f54976187f51d865ddd
SHA1

b97e49007f7d75ae33bf67de303a737a1bb1e080
SHA256

8bb7089cb231edd0bd09d9611b41f6f23e12e5110dee1c97a1346ef57198c41f
SHA512

456912d32483c0ac9bc0560eccfab23ed6fa9fbffb15b97a889b5806b2831e73f49b6190deb9d70543c49a1fd0186d1c7df5b2cf77574c4dac4a65fb0d1e2282

Score

8^/10

persistence

Malware Config

Signatures

Blacklisted process makes network request 2 IoCs

Processes:

rundll32.exerundll32.exe

flow pid process

6 1768 rundll32.exe
10 1284 rundll32.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1424 schtasks.exe
NTFS ADS 1 IoCs

Processes:

983909e9e67f6f54976187f51d865ddd.exe

description ioc process

File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier 983909e9e67f6f54976187f51d865ddd.exe

flow	pid	process
6	1768	rundll32.exe
10	1284	rundll32.exe

pid	process
1424	schtasks.exe

description	ioc	process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	983909e9e67f6f54976187f51d865ddd.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

REG.exeREG.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Loads dropped DLL 10 IoCs

Processes:

983909e9e67f6f54976187f51d865ddd.exerundll32.exerundll32.exe

pid	process
1460	983909e9e67f6f54976187f51d865ddd.exe
1460	983909e9e67f6f54976187f51d865ddd.exe
1768	rundll32.exe
1768	rundll32.exe
1768	rundll32.exe
1768	rundll32.exe
1284	rundll32.exe
1284	rundll32.exe
1284	rundll32.exe
1284	rundll32.exe

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

983909e9e67f6f54976187f51d865ddd.exebdif.execmd.exe

description	pid	process	target process
PID 1460 wrote to memory of 1484	1460	983909e9e67f6f54976187f51d865ddd.exe	bdif.exe
PID 1460 wrote to memory of 1484	1460	983909e9e67f6f54976187f51d865ddd.exe	bdif.exe
PID 1460 wrote to memory of 1484	1460	983909e9e67f6f54976187f51d865ddd.exe	bdif.exe
PID 1460 wrote to memory of 1484	1460	983909e9e67f6f54976187f51d865ddd.exe	bdif.exe
PID 1484 wrote to memory of 1796	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1796	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1796	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1796	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1768	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1856	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1856	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1856	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1856	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 1284	1484	bdif.exe	rundll32.exe
PID 1484 wrote to memory of 2016	1484	bdif.exe	cmd.exe
PID 1484 wrote to memory of 2016	1484	bdif.exe	cmd.exe
PID 1484 wrote to memory of 2016	1484	bdif.exe	cmd.exe
PID 1484 wrote to memory of 2016	1484	bdif.exe	cmd.exe
PID 1484 wrote to memory of 2024	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 2024	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 2024	1484	bdif.exe	REG.exe
PID 1484 wrote to memory of 2024	1484	bdif.exe	REG.exe
PID 2016 wrote to memory of 1424	2016	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 1424	2016	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 1424	2016	cmd.exe	schtasks.exe
PID 2016 wrote to memory of 1424	2016	cmd.exe	schtasks.exe

Executes dropped EXE 1 IoCs

Processes:

bdif.exe

pid process

1484 bdif.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

rundll32.exe

pid process

1768 rundll32.exe
1768 rundll32.exe

pid	process
1484	bdif.exe

pid	process
1768	rundll32.exe
1768	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\983909e9e67f6f54976187f51d865ddd.exe
"C:\Users\Admin\AppData\Local\Temp\983909e9e67f6f54976187f51d865ddd.exe"
1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460

\??\c:\programdata\1321ba6d1f\bdif.exe
c:\programdata\1321ba6d1f\bdif.exe
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1484

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
3⤵
- Adds Run key to start application
PID:1796

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
3⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1768

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
3⤵
- Adds Run key to start application
PID:1856

C:\Windows\SysWOW64\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
3⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:1284

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
3⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\schtasks.exe
SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
4⤵
- Creates scheduled task(s)
PID:1424

C:\Windows\SysWOW64\REG.exe
REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
3⤵
PID:2024