5df97284c32afb8a994a9b771f1af0efe9696d6e4591bb7c3d0791ae7238348e

General

Target
dd698d32cc668372d09462595980ab4f.exe
Size 906KB
Sample200804-rzewgpcmas
SHA256 5df97284c32afb8a994a9b771f1af0efe9696d6e4591bb7c3d0791ae7238348e
MD5 dd698d32cc668372d09462595980ab4f
SHA1 22b57b5bb13e44b51c4340860f4122c3da4fbaae
SHA512 5295403924f172cfd187cba15022689aed775b09ee0f0dcc518bac5c80f331555ec7a9860e3952bfb9dc3cd077f048f5cde0b61efb874846e27f0490eb95f3fa
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2764	3056	dd698d32cc668372d09462595980ab4f.exe	67
PID 3056 wrote to memory of 2764	3056	dd698d32cc668372d09462595980ab4f.exe	67
PID 3056 wrote to memory of 2764	3056	dd698d32cc668372d09462595980ab4f.exe	67
PID 2764 wrote to memory of 892	2764	bdif.exe	68
PID 2764 wrote to memory of 892	2764	bdif.exe	68
PID 2764 wrote to memory of 892	2764	bdif.exe	68
PID 2764 wrote to memory of 992	2764	bdif.exe	69
PID 2764 wrote to memory of 992	2764	bdif.exe	69
PID 2764 wrote to memory of 992	2764	bdif.exe	69
PID 2764 wrote to memory of 1204	2764	bdif.exe	71
PID 2764 wrote to memory of 1204	2764	bdif.exe	71
PID 2764 wrote to memory of 1204	2764	bdif.exe	71
PID 2764 wrote to memory of 1192	2764	bdif.exe	72
PID 2764 wrote to memory of 1192	2764	bdif.exe	72
PID 2764 wrote to memory of 1192	2764	bdif.exe	72
PID 2764 wrote to memory of 3384	2764	bdif.exe	80
PID 2764 wrote to memory of 3384	2764	bdif.exe	80
PID 2764 wrote to memory of 3384	2764	bdif.exe	80
PID 2764 wrote to memory of 3340	2764	bdif.exe	81
PID 2764 wrote to memory of 3340	2764	bdif.exe	81
PID 2764 wrote to memory of 3340	2764	bdif.exe	81
PID 3384 wrote to memory of 2936	3384	cmd.exe	84
PID 3384 wrote to memory of 2936	3384	cmd.exe	84
PID 3384 wrote to memory of 2936	3384	cmd.exe	84

Executes dropped EXE 1 IoCs

pid	Process
2764	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
992	rundll32.exe
1192	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
992	rundll32.exe
992	rundll32.exe
992	rundll32.exe
992	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	992	rundll32.exe
7	1192	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	dd698d32cc668372d09462595980ab4f.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2936	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\dd698d32cc668372d09462595980ab4f.exe
"C:\Users\Admin\AppData\Local\Temp\dd698d32cc668372d09462595980ab4f.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:3056
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:2764
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:892
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:992
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:1204
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:1192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:2936
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3340