ba8850853f6143b09cc78cf2aaa6373b8d00140290fc82c02fd1b045d202bf26

General

Target
c6e45d8e072b18669d7ffad590ddee0e.exe
Size 906KB
Sample200805-74pgr9vct2
SHA256 ba8850853f6143b09cc78cf2aaa6373b8d00140290fc82c02fd1b045d202bf26
MD5 c6e45d8e072b18669d7ffad590ddee0e
SHA1 2638be76231b7ae24c21e439adad230250070fc0
SHA512 7306af2b5f332a973aadb63ff32a22078ac2f042b50b94ba344b4266ca34b838a1768ae44be61f094529d7e0282bd6485843bcf26ca3be88fb12ebda0b5b7b50
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3392	schtasks.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 3112	2920	c6e45d8e072b18669d7ffad590ddee0e.exe	67
PID 2920 wrote to memory of 3112	2920	c6e45d8e072b18669d7ffad590ddee0e.exe	67
PID 2920 wrote to memory of 3112	2920	c6e45d8e072b18669d7ffad590ddee0e.exe	67
PID 3112 wrote to memory of 3828	3112	bdif.exe	68
PID 3112 wrote to memory of 3828	3112	bdif.exe	68
PID 3112 wrote to memory of 3828	3112	bdif.exe	68
PID 3112 wrote to memory of 1460	3112	bdif.exe	69
PID 3112 wrote to memory of 1460	3112	bdif.exe	69
PID 3112 wrote to memory of 1460	3112	bdif.exe	69
PID 3112 wrote to memory of 3820	3112	bdif.exe	71
PID 3112 wrote to memory of 3820	3112	bdif.exe	71
PID 3112 wrote to memory of 3820	3112	bdif.exe	71
PID 3112 wrote to memory of 3924	3112	bdif.exe	72
PID 3112 wrote to memory of 3924	3112	bdif.exe	72
PID 3112 wrote to memory of 3924	3112	bdif.exe	72
PID 3112 wrote to memory of 3396	3112	bdif.exe	74
PID 3112 wrote to memory of 3396	3112	bdif.exe	74
PID 3112 wrote to memory of 3396	3112	bdif.exe	74
PID 3112 wrote to memory of 3436	3112	bdif.exe	75
PID 3112 wrote to memory of 3436	3112	bdif.exe	75
PID 3112 wrote to memory of 3436	3112	bdif.exe	75
PID 3396 wrote to memory of 3392	3396	cmd.exe	78
PID 3396 wrote to memory of 3392	3396	cmd.exe	78
PID 3396 wrote to memory of 3392	3396	cmd.exe	78

Executes dropped EXE 1 IoCs

pid	Process
3112	bdif.exe

Loads dropped DLL 3 IoCs

pid	Process
1460	rundll32.exe
3924	rundll32.exe
3924	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe
1460	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
3	1460	rundll32.exe
11	3924	rundll32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	c6e45d8e072b18669d7ffad590ddee0e.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe

C:\Users\Admin\AppData\Local\Temp\c6e45d8e072b18669d7ffad590ddee0e.exe
"C:\Users\Admin\AppData\Local\Temp\c6e45d8e072b18669d7ffad590ddee0e.exe"
1⤵
- Suspicious use of WriteProcessMemory
- NTFS ADS
PID:2920
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3112
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3828
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:1460
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3820
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:3924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:3392
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3436