Analysis
- max time kernel
138s - max time network
146s - platform
windows7_x64 - resource
win7 - submitted
02/08/2020, 11:09
Static task
static1
Behavioral task
behavioral1
Sample
6513c2b1ba28069e82ba3862a9394316.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
6513c2b1ba28069e82ba3862a9394316.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 6513c2b1ba28069e82ba3862a9394316.exe
- Size 1.1MB
- Sample200802-6e44rx4gme
- SHA256 422046dea0f6a4760bef5ec950587e14932fd938a6dea7e79d7788bcb28fbaca
- MD5 6513c2b1ba28069e82ba3862a9394316
- SHA1 243f62e6c8eaf4cb45eb9fa667e2db406597256f
- SHA512 1094b102e676078cc0b6f112d228ce12661a03a51fd78164f0a8fc9f24943532df7a7f8666c35aaf8ad0919fdbcbe682726e0e67490130f6899c8eba54051d57
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1612 wrote to memory of 364 1612 6513c2b1ba28069e82ba3862a9394316.exe 24 PID 1612 wrote to memory of 364 1612 6513c2b1ba28069e82ba3862a9394316.exe 24 PID 1612 wrote to memory of 364 1612 6513c2b1ba28069e82ba3862a9394316.exe 24 PID 1612 wrote to memory of 364 1612 6513c2b1ba28069e82ba3862a9394316.exe 24 PID 364 wrote to memory of 1888 364 bdif.exe 27 PID 364 wrote to memory of 1888 364 bdif.exe 27 PID 364 wrote to memory of 1888 364 bdif.exe 27 PID 364 wrote to memory of 1888 364 bdif.exe 27 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1912 364 bdif.exe 28 PID 364 wrote to memory of 1952 364 bdif.exe 30 PID 364 wrote to memory of 1952 364 bdif.exe 30 PID 364 wrote to memory of 1952 364 bdif.exe 30 PID 364 wrote to memory of 1952 364 bdif.exe 30 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1980 364 bdif.exe 31 PID 364 wrote to memory of 1264 364 bdif.exe 35 PID 364 wrote to memory of 1264 364 bdif.exe 35 PID 364 wrote to memory of 1264 364 bdif.exe 35 PID 364 wrote to memory of 1264 364 bdif.exe 35 PID 364 wrote to memory of 1448 364 bdif.exe 36 PID 364 wrote to memory of 1448 364 bdif.exe 36 PID 364 wrote to memory of 1448 364 bdif.exe 36 PID 364 wrote to memory of 1448 364 bdif.exe 36 PID 1264 wrote to memory of 1440 1264 cmd.exe 39 PID 1264 wrote to memory of 1440 1264 cmd.exe 39 PID 1264 wrote to memory of 1440 1264 cmd.exe 39 PID 1264 wrote to memory of 1440 1264 cmd.exe 39 - Executes dropped EXE 1 IoCs
pid Process 364 bdif.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1912 rundll32.exe 1912 rundll32.exe - Blacklisted process makes network request 2 IoCs
flow pid Process 6 1912 rundll32.exe 10 1980 rundll32.exe - NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier 6513c2b1ba28069e82ba3862a9394316.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1440 schtasks.exe - Loads dropped DLL 10 IoCs
pid Process 1612 6513c2b1ba28069e82ba3862a9394316.exe 1612 6513c2b1ba28069e82ba3862a9394316.exe 1912 rundll32.exe 1912 rundll32.exe 1912 rundll32.exe 1912 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe 1980 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6513c2b1ba28069e82ba3862a9394316.exe"C:\Users\Admin\AppData\Local\Temp\6513c2b1ba28069e82ba3862a9394316.exe"1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
- Loads dropped DLL
PID:1612 -
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:364 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
PID:1888
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Suspicious behavior: EnumeratesProcesses
- Blacklisted process makes network request
- Loads dropped DLL
PID:1912
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
PID:1952
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:1980
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
PID:1440
-
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d3⤵PID:1448
-
-