422046dea0f6a4760bef5ec950587e14932fd938a6dea7e79d7788bcb28fbaca

General

Target
6513c2b1ba28069e82ba3862a9394316.exe
Size 1.1MB
Sample200802-6e44rx4gme
SHA256 422046dea0f6a4760bef5ec950587e14932fd938a6dea7e79d7788bcb28fbaca
MD5 6513c2b1ba28069e82ba3862a9394316
SHA1 243f62e6c8eaf4cb45eb9fa667e2db406597256f
SHA512 1094b102e676078cc0b6f112d228ce12661a03a51fd78164f0a8fc9f24943532df7a7f8666c35aaf8ad0919fdbcbe682726e0e67490130f6899c8eba54051d57
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
568	bdif.exe

Loads dropped DLL 4 IoCs

pid	Process
3608	rundll32.exe
3608	rundll32.exe
2432	rundll32.exe
2432	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3608	rundll32.exe
3608	rundll32.exe
3608	rundll32.exe
3608	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	3608	rundll32.exe
12	2432	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
748	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	6513c2b1ba28069e82ba3862a9394316.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 568	408	6513c2b1ba28069e82ba3862a9394316.exe	66
PID 408 wrote to memory of 568	408	6513c2b1ba28069e82ba3862a9394316.exe	66
PID 408 wrote to memory of 568	408	6513c2b1ba28069e82ba3862a9394316.exe	66
PID 568 wrote to memory of 3616	568	bdif.exe	67
PID 568 wrote to memory of 3616	568	bdif.exe	67
PID 568 wrote to memory of 3616	568	bdif.exe	67
PID 568 wrote to memory of 3608	568	bdif.exe	68
PID 568 wrote to memory of 3608	568	bdif.exe	68
PID 568 wrote to memory of 3608	568	bdif.exe	68
PID 568 wrote to memory of 2420	568	bdif.exe	72
PID 568 wrote to memory of 2420	568	bdif.exe	72
PID 568 wrote to memory of 2420	568	bdif.exe	72
PID 568 wrote to memory of 2432	568	bdif.exe	73
PID 568 wrote to memory of 2432	568	bdif.exe	73
PID 568 wrote to memory of 2432	568	bdif.exe	73
PID 568 wrote to memory of 3184	568	bdif.exe	79
PID 568 wrote to memory of 3184	568	bdif.exe	79
PID 568 wrote to memory of 3184	568	bdif.exe	79
PID 568 wrote to memory of 3448	568	bdif.exe	80
PID 568 wrote to memory of 3448	568	bdif.exe	80
PID 568 wrote to memory of 3448	568	bdif.exe	80
PID 3184 wrote to memory of 748	3184	cmd.exe	83
PID 3184 wrote to memory of 748	3184	cmd.exe	83
PID 3184 wrote to memory of 748	3184	cmd.exe	83

C:\Users\Admin\AppData\Local\Temp\6513c2b1ba28069e82ba3862a9394316.exe
"C:\Users\Admin\AppData\Local\Temp\6513c2b1ba28069e82ba3862a9394316.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:408
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:568
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3616
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:3608
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:2420
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3184
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:748
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3448