1afefa89693d4e1d7011a0a41447babc5dc526cced99039e969cb6a0a668f5f7

General

Target
c4544bc7266585d57059928b63cb7b8d.exe
Size 1.1MB
Sample200731-v66cfpgbnx
SHA256 1afefa89693d4e1d7011a0a41447babc5dc526cced99039e969cb6a0a668f5f7
MD5 c4544bc7266585d57059928b63cb7b8d
SHA1 9faca02e36db73839a403fdfe2cac686004f9fb7
SHA512 7a179a5379b3dced50b8a4ca34adcbb6b82fb2529ac5cc6a64881aba93b8f7b4f027cd198b6ef6f999d423f7f00537c5bf9d3ab1ac37b096935c4ac0f45a7421
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
900	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
1224	rundll32.exe
1576	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe
1224	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	1224	rundll32.exe
7	1576	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	c4544bc7266585d57059928b63cb7b8d.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1852	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 900	728	c4544bc7266585d57059928b63cb7b8d.exe	67
PID 728 wrote to memory of 900	728	c4544bc7266585d57059928b63cb7b8d.exe	67
PID 728 wrote to memory of 900	728	c4544bc7266585d57059928b63cb7b8d.exe	67
PID 900 wrote to memory of 1100	900	bdif.exe	68
PID 900 wrote to memory of 1100	900	bdif.exe	68
PID 900 wrote to memory of 1100	900	bdif.exe	68
PID 900 wrote to memory of 1224	900	bdif.exe	69
PID 900 wrote to memory of 1224	900	bdif.exe	69
PID 900 wrote to memory of 1224	900	bdif.exe	69
PID 900 wrote to memory of 1488	900	bdif.exe	71
PID 900 wrote to memory of 1488	900	bdif.exe	71
PID 900 wrote to memory of 1488	900	bdif.exe	71
PID 900 wrote to memory of 1576	900	bdif.exe	72
PID 900 wrote to memory of 1576	900	bdif.exe	72
PID 900 wrote to memory of 1576	900	bdif.exe	72
PID 900 wrote to memory of 1604	900	bdif.exe	80
PID 900 wrote to memory of 1604	900	bdif.exe	80
PID 900 wrote to memory of 1604	900	bdif.exe	80
PID 900 wrote to memory of 3876	900	bdif.exe	81
PID 900 wrote to memory of 3876	900	bdif.exe	81
PID 900 wrote to memory of 3876	900	bdif.exe	81
PID 1604 wrote to memory of 1852	1604	cmd.exe	84
PID 1604 wrote to memory of 1852	1604	cmd.exe	84
PID 1604 wrote to memory of 1852	1604	cmd.exe	84

C:\Users\Admin\AppData\Local\Temp\c4544bc7266585d57059928b63cb7b8d.exe
"C:\Users\Admin\AppData\Local\Temp\c4544bc7266585d57059928b63cb7b8d.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:728
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:900
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1100
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:1224
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1488
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1604
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:1852
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3876