b0492ee53bdfcde8453259a3f9e63ae29a11ef277afa0cd4ad1339e873f61af0

General

Target
b6ee6ce88277bf7d0a9a7bc50dee30fc.exe
Size 875KB
Sample200803-l9chnyyafs
SHA256 b0492ee53bdfcde8453259a3f9e63ae29a11ef277afa0cd4ad1339e873f61af0
MD5 b6ee6ce88277bf7d0a9a7bc50dee30fc
SHA1 15dfbaea0fbbd9241195005ed27f2d8a9d1a2d67
SHA512 040d0f04428d2506c2336362bd89e92c215399e6abd8c3d166da015039b77b6f1149314152b1691ac8822f2f48c570e5c35061c6731b53c52f079794c6876e73
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3952	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3556	3816	b6ee6ce88277bf7d0a9a7bc50dee30fc.exe	66
PID 3816 wrote to memory of 3556	3816	b6ee6ce88277bf7d0a9a7bc50dee30fc.exe	66
PID 3816 wrote to memory of 3556	3816	b6ee6ce88277bf7d0a9a7bc50dee30fc.exe	66
PID 3556 wrote to memory of 3872	3556	bdif.exe	67
PID 3556 wrote to memory of 3872	3556	bdif.exe	67
PID 3556 wrote to memory of 3872	3556	bdif.exe	67
PID 3556 wrote to memory of 2692	3556	bdif.exe	68
PID 3556 wrote to memory of 2692	3556	bdif.exe	68
PID 3556 wrote to memory of 2692	3556	bdif.exe	68
PID 3556 wrote to memory of 748	3556	bdif.exe	70
PID 3556 wrote to memory of 748	3556	bdif.exe	70
PID 3556 wrote to memory of 748	3556	bdif.exe	70
PID 3556 wrote to memory of 892	3556	bdif.exe	71
PID 3556 wrote to memory of 892	3556	bdif.exe	71
PID 3556 wrote to memory of 892	3556	bdif.exe	71
PID 3556 wrote to memory of 1720	3556	bdif.exe	79
PID 3556 wrote to memory of 1720	3556	bdif.exe	79
PID 3556 wrote to memory of 1720	3556	bdif.exe	79
PID 3556 wrote to memory of 3800	3556	bdif.exe	80
PID 3556 wrote to memory of 3800	3556	bdif.exe	80
PID 3556 wrote to memory of 3800	3556	bdif.exe	80
PID 1720 wrote to memory of 3952	1720	cmd.exe	83
PID 1720 wrote to memory of 3952	1720	cmd.exe	83
PID 1720 wrote to memory of 3952	1720	cmd.exe	83

Executes dropped EXE 1 IoCs

pid	Process
3556	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
2692	rundll32.exe
892	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2692	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe
2692	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	2692	rundll32.exe
7	892	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	b6ee6ce88277bf7d0a9a7bc50dee30fc.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

C:\Users\Admin\AppData\Local\Temp\b6ee6ce88277bf7d0a9a7bc50dee30fc.exe
"C:\Users\Admin\AppData\Local\Temp\b6ee6ce88277bf7d0a9a7bc50dee30fc.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:3816
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3556
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3872
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:2692
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:748
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1720
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:3952
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3800