91f2a7c86a37b30b28f927cbb90a4964a5255fab9ef3d42271b15ebca24929b8

General

Target
e06c1f3d1821c6c6a0999e8228808738.exe
Size 1.3MB
Sample200805-d64hkzqdd2
SHA256 91f2a7c86a37b30b28f927cbb90a4964a5255fab9ef3d42271b15ebca24929b8
MD5 e06c1f3d1821c6c6a0999e8228808738
SHA1 fe41031ec87b7a076bb2bcddde55879a515454c0
SHA512 1dd5ffeceadd4d5028ff9656904a890bd65d1bdb3fa4eb93c269f8138200c6f4964e3c0e2c74a0ff2bec2e6003eeaebd20c844ebe7f36c5fc518c7b64d491796
MD5 SHA1 SHA512

Score

8^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3376	rundll32.exe
3376	rundll32.exe
3376	rundll32.exe
3376	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
5	3376	rundll32.exe
9	3848	rundll32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1360	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	e06c1f3d1821c6c6a0999e8228808738.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3076	1848	e06c1f3d1821c6c6a0999e8228808738.exe	67
PID 1848 wrote to memory of 3076	1848	e06c1f3d1821c6c6a0999e8228808738.exe	67
PID 1848 wrote to memory of 3076	1848	e06c1f3d1821c6c6a0999e8228808738.exe	67
PID 3076 wrote to memory of 3796	3076	bdif.exe	68
PID 3076 wrote to memory of 3796	3076	bdif.exe	68
PID 3076 wrote to memory of 3796	3076	bdif.exe	68
PID 3076 wrote to memory of 3376	3076	bdif.exe	69
PID 3076 wrote to memory of 3376	3076	bdif.exe	69
PID 3076 wrote to memory of 3376	3076	bdif.exe	69
PID 3076 wrote to memory of 3892	3076	bdif.exe	71
PID 3076 wrote to memory of 3892	3076	bdif.exe	71
PID 3076 wrote to memory of 3892	3076	bdif.exe	71
PID 3076 wrote to memory of 3848	3076	bdif.exe	72
PID 3076 wrote to memory of 3848	3076	bdif.exe	72
PID 3076 wrote to memory of 3848	3076	bdif.exe	72
PID 3076 wrote to memory of 884	3076	bdif.exe	76
PID 3076 wrote to memory of 884	3076	bdif.exe	76
PID 3076 wrote to memory of 884	3076	bdif.exe	76
PID 3076 wrote to memory of 1044	3076	bdif.exe	77
PID 3076 wrote to memory of 1044	3076	bdif.exe	77
PID 3076 wrote to memory of 1044	3076	bdif.exe	77
PID 884 wrote to memory of 1360	884	cmd.exe	80
PID 884 wrote to memory of 1360	884	cmd.exe	80
PID 884 wrote to memory of 1360	884	cmd.exe	80

Executes dropped EXE 1 IoCs

pid	Process
3076	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
3376	rundll32.exe
3848	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\e06c1f3d1821c6c6a0999e8228808738.exe
"C:\Users\Admin\AppData\Local\Temp\e06c1f3d1821c6c6a0999e8228808738.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1848
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:3076
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3796
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    - Loads dropped DLL
    PID:3376
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3892
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Blacklisted process makes network request
    - Loads dropped DLL
    PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:884
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:1360
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:1044