5ca5fa929ab863af78c32e7a5b2a2e2594ec6bcccfa4e5413868fbcc26f5827a

General

Target
8efd2f2e97c90be61790f6128726229e.exe
Size 1.6MB
Sample200804-7c8161b6ra
SHA256 5ca5fa929ab863af78c32e7a5b2a2e2594ec6bcccfa4e5413868fbcc26f5827a
MD5 8efd2f2e97c90be61790f6128726229e
SHA1 1757a179f671c3af8cc50ef6d18104c508916f42
SHA512 cdb1627e54c49ca78936e48c66ff55bfaffbd6d499283fd0869b60d4653ce55a770825846726bb0217dfa760a4e7dbe6d49e5ff2f3cf50d2b377f9656f80e695
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
752	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3752	3488	8efd2f2e97c90be61790f6128726229e.exe	66
PID 3488 wrote to memory of 3752	3488	8efd2f2e97c90be61790f6128726229e.exe	66
PID 3488 wrote to memory of 3752	3488	8efd2f2e97c90be61790f6128726229e.exe	66
PID 3752 wrote to memory of 724	3752	bdif.exe	67
PID 3752 wrote to memory of 724	3752	bdif.exe	67
PID 3752 wrote to memory of 724	3752	bdif.exe	67
PID 3752 wrote to memory of 816	3752	bdif.exe	68
PID 3752 wrote to memory of 816	3752	bdif.exe	68
PID 3752 wrote to memory of 816	3752	bdif.exe	68
PID 3752 wrote to memory of 608	3752	bdif.exe	70
PID 3752 wrote to memory of 608	3752	bdif.exe	70
PID 3752 wrote to memory of 608	3752	bdif.exe	70
PID 3752 wrote to memory of 1080	3752	bdif.exe	71
PID 3752 wrote to memory of 1080	3752	bdif.exe	71
PID 3752 wrote to memory of 1080	3752	bdif.exe	71
PID 3752 wrote to memory of 3068	3752	bdif.exe	79
PID 3752 wrote to memory of 3068	3752	bdif.exe	79
PID 3752 wrote to memory of 3068	3752	bdif.exe	79
PID 3752 wrote to memory of 3220	3752	bdif.exe	80
PID 3752 wrote to memory of 3220	3752	bdif.exe	80
PID 3752 wrote to memory of 3220	3752	bdif.exe	80
PID 3068 wrote to memory of 752	3068	cmd.exe	83
PID 3068 wrote to memory of 752	3068	cmd.exe	83
PID 3068 wrote to memory of 752	3068	cmd.exe	83

Executes dropped EXE 1 IoCs

pid	Process
3752	bdif.exe

Loads dropped DLL 3 IoCs

pid	Process
816	rundll32.exe
1080	rundll32.exe
1080	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe
816	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	816	rundll32.exe
7	1080	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	8efd2f2e97c90be61790f6128726229e.exe

C:\Users\Admin\AppData\Local\Temp\8efd2f2e97c90be61790f6128726229e.exe
"C:\Users\Admin\AppData\Local\Temp\8efd2f2e97c90be61790f6128726229e.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:3488
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3752
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:724
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:816
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:608
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:752
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3220