Analysis
- max time kernel
138s - max time network
147s - platform
windows7_x64 - resource
win7 - submitted
04/08/2020, 09:13
Static task
static1
Behavioral task
behavioral1
Sample
8efd2f2e97c90be61790f6128726229e.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8efd2f2e97c90be61790f6128726229e.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 8efd2f2e97c90be61790f6128726229e.exe
- Size 1.6MB
- Sample200804-7c8161b6ra
- SHA256 5ca5fa929ab863af78c32e7a5b2a2e2594ec6bcccfa4e5413868fbcc26f5827a
- MD5 8efd2f2e97c90be61790f6128726229e
- SHA1 1757a179f671c3af8cc50ef6d18104c508916f42
- SHA512 cdb1627e54c49ca78936e48c66ff55bfaffbd6d499283fd0869b60d4653ce55a770825846726bb0217dfa760a4e7dbe6d49e5ff2f3cf50d2b377f9656f80e695
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Blacklisted process makes network request 2 IoCs
flow pid Process 6 1780 rundll32.exe 10 1884 rundll32.exe - NTFS ADS 1 IoCs
description ioc Process File created \??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier 8efd2f2e97c90be61790f6128726229e.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main" REG.exe Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main" REG.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1416 schtasks.exe - Loads dropped DLL 10 IoCs
pid Process 1460 8efd2f2e97c90be61790f6128726229e.exe 1460 8efd2f2e97c90be61790f6128726229e.exe 1780 rundll32.exe 1780 rundll32.exe 1780 rundll32.exe 1780 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe 1884 rundll32.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1460 wrote to memory of 1484 1460 8efd2f2e97c90be61790f6128726229e.exe 24 PID 1460 wrote to memory of 1484 1460 8efd2f2e97c90be61790f6128726229e.exe 24 PID 1460 wrote to memory of 1484 1460 8efd2f2e97c90be61790f6128726229e.exe 24 PID 1460 wrote to memory of 1484 1460 8efd2f2e97c90be61790f6128726229e.exe 24 PID 1484 wrote to memory of 1788 1484 bdif.exe 27 PID 1484 wrote to memory of 1788 1484 bdif.exe 27 PID 1484 wrote to memory of 1788 1484 bdif.exe 27 PID 1484 wrote to memory of 1788 1484 bdif.exe 27 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1780 1484 bdif.exe 28 PID 1484 wrote to memory of 1124 1484 bdif.exe 30 PID 1484 wrote to memory of 1124 1484 bdif.exe 30 PID 1484 wrote to memory of 1124 1484 bdif.exe 30 PID 1484 wrote to memory of 1124 1484 bdif.exe 30 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 1884 1484 bdif.exe 31 PID 1484 wrote to memory of 2024 1484 bdif.exe 35 PID 1484 wrote to memory of 2024 1484 bdif.exe 35 PID 1484 wrote to memory of 2024 1484 bdif.exe 35 PID 1484 wrote to memory of 2024 1484 bdif.exe 35 PID 1484 wrote to memory of 1996 1484 bdif.exe 36 PID 1484 wrote to memory of 1996 1484 bdif.exe 36 PID 1484 wrote to memory of 1996 1484 bdif.exe 36 PID 1484 wrote to memory of 1996 1484 bdif.exe 36 PID 2024 wrote to memory of 1416 2024 cmd.exe 39 PID 2024 wrote to memory of 1416 2024 cmd.exe 39 PID 2024 wrote to memory of 1416 2024 cmd.exe 39 PID 2024 wrote to memory of 1416 2024 cmd.exe 39 - Executes dropped EXE 1 IoCs
pid Process 1484 bdif.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1780 rundll32.exe 1780 rundll32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8efd2f2e97c90be61790f6128726229e.exe"C:\Users\Admin\AppData\Local\Temp\8efd2f2e97c90be61790f6128726229e.exe"1⤵
- NTFS ADS
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460 -
\??\c:\programdata\1321ba6d1f\bdif.exec:\programdata\1321ba6d1f\bdif.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1484 -
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"3⤵
- Adds Run key to start application
PID:1788
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main3⤵
- Blacklisted process makes network request
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1780
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"3⤵
- Adds Run key to start application
PID:1124
-
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main3⤵
- Blacklisted process makes network request
- Loads dropped DLL
PID:1884
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe3⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe4⤵
- Creates scheduled task(s)
PID:1416
-
-
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f3⤵PID:1996
-
-