565dd05e9af2bc368094e8b0f533e54b4f9e677b03805bd48054d78cc2e0df46

General

Target
c2fdf0ff957d16bc5ee6157268d34026.exe
Size 1.6MB
Sample200804-nn27l9bphx
SHA256 565dd05e9af2bc368094e8b0f533e54b4f9e677b03805bd48054d78cc2e0df46
MD5 c2fdf0ff957d16bc5ee6157268d34026
SHA1 8bfcd8c8677887995aa54303e10e7aad68222d13
SHA512 fb2dfc22cc2583ee7c6eaf19d2db11dd59e7e52c431a0e68f86fe997664251bdd29f1b7028125b8757fb3534d319c6e3baab01bfa3fda3c0ec25e56f85cda094
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
632	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	c2fdf0ff957d16bc5ee6157268d34026.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3888 wrote to memory of 3616	3888	c2fdf0ff957d16bc5ee6157268d34026.exe	67
PID 3888 wrote to memory of 3616	3888	c2fdf0ff957d16bc5ee6157268d34026.exe	67
PID 3888 wrote to memory of 3616	3888	c2fdf0ff957d16bc5ee6157268d34026.exe	67
PID 3616 wrote to memory of 3896	3616	bdif.exe	68
PID 3616 wrote to memory of 3896	3616	bdif.exe	68
PID 3616 wrote to memory of 3896	3616	bdif.exe	68
PID 3616 wrote to memory of 3828	3616	bdif.exe	69
PID 3616 wrote to memory of 3828	3616	bdif.exe	69
PID 3616 wrote to memory of 3828	3616	bdif.exe	69
PID 3616 wrote to memory of 3380	3616	bdif.exe	71
PID 3616 wrote to memory of 3380	3616	bdif.exe	71
PID 3616 wrote to memory of 3380	3616	bdif.exe	71
PID 3616 wrote to memory of 2508	3616	bdif.exe	72
PID 3616 wrote to memory of 2508	3616	bdif.exe	72
PID 3616 wrote to memory of 2508	3616	bdif.exe	72
PID 3616 wrote to memory of 1796	3616	bdif.exe	76
PID 3616 wrote to memory of 1796	3616	bdif.exe	76
PID 3616 wrote to memory of 1796	3616	bdif.exe	76
PID 3616 wrote to memory of 1996	3616	bdif.exe	77
PID 3616 wrote to memory of 1996	3616	bdif.exe	77
PID 3616 wrote to memory of 1996	3616	bdif.exe	77
PID 1796 wrote to memory of 632	1796	cmd.exe	80
PID 1796 wrote to memory of 632	1796	cmd.exe	80
PID 1796 wrote to memory of 632	1796	cmd.exe	80

Executes dropped EXE 1 IoCs

pid	Process
3616	bdif.exe

Loads dropped DLL 3 IoCs

pid	Process
3828	rundll32.exe
3828	rundll32.exe
2508	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3828	rundll32.exe
3828	rundll32.exe
3828	rundll32.exe
3828	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	3828	rundll32.exe
7	2508	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\c2fdf0ff957d16bc5ee6157268d34026.exe
"C:\Users\Admin\AppData\Local\Temp\c2fdf0ff957d16bc5ee6157268d34026.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:3888
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3616
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3896
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:3828
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3380
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:2508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:632
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:1996