f4ab217ae09b0a6d32aae4fcdc87f64a79caa98619487724d6e52a75bcaddd26

General

Target
034572d8a597e2758e8a97021d817b20.exe
Size 1.3MB
Sample200805-ejdgz8kn5j
SHA256 f4ab217ae09b0a6d32aae4fcdc87f64a79caa98619487724d6e52a75bcaddd26
MD5 034572d8a597e2758e8a97021d817b20
SHA1 dd10b0e77b4d6b40c82cc955128155dcb8b725f0
SHA512 a29ff89e47531f70c64206ad0374229b4a3013b99b1815b7c681576b5c096aafba66ec938c78d46e590e612220fee407bd9a9f84a2628ee18115a7bc218d77ef
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3352	schtasks.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	\??\c:\programdata\1321ba6d1f\bdif.exe:Zone.Identifier	034572d8a597e2758e8a97021d817b20.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\scr = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\scr.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\cred = "rundll32 C:\\Users\\Admin\\AppData\\Local\\Temp\\cred.dll, Main"	REG.exe
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run	REG.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 1232	720	034572d8a597e2758e8a97021d817b20.exe	67
PID 720 wrote to memory of 1232	720	034572d8a597e2758e8a97021d817b20.exe	67
PID 720 wrote to memory of 1232	720	034572d8a597e2758e8a97021d817b20.exe	67
PID 1232 wrote to memory of 3692	1232	bdif.exe	68
PID 1232 wrote to memory of 3692	1232	bdif.exe	68
PID 1232 wrote to memory of 3692	1232	bdif.exe	68
PID 1232 wrote to memory of 3584	1232	bdif.exe	69
PID 1232 wrote to memory of 3584	1232	bdif.exe	69
PID 1232 wrote to memory of 3584	1232	bdif.exe	69
PID 1232 wrote to memory of 3784	1232	bdif.exe	71
PID 1232 wrote to memory of 3784	1232	bdif.exe	71
PID 1232 wrote to memory of 3784	1232	bdif.exe	71
PID 1232 wrote to memory of 3768	1232	bdif.exe	72
PID 1232 wrote to memory of 3768	1232	bdif.exe	72
PID 1232 wrote to memory of 3768	1232	bdif.exe	72
PID 1232 wrote to memory of 3424	1232	bdif.exe	74
PID 1232 wrote to memory of 3424	1232	bdif.exe	74
PID 1232 wrote to memory of 3424	1232	bdif.exe	74
PID 1232 wrote to memory of 3160	1232	bdif.exe	75
PID 1232 wrote to memory of 3160	1232	bdif.exe	75
PID 1232 wrote to memory of 3160	1232	bdif.exe	75
PID 3424 wrote to memory of 3352	3424	cmd.exe	78
PID 3424 wrote to memory of 3352	3424	cmd.exe	78
PID 3424 wrote to memory of 3352	3424	cmd.exe	78

Executes dropped EXE 1 IoCs

pid	Process
1232	bdif.exe

Loads dropped DLL 2 IoCs

pid	Process
3584	rundll32.exe
3768	rundll32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3584	rundll32.exe
3584	rundll32.exe
3584	rundll32.exe
3584	rundll32.exe

Blacklisted process makes network request 2 IoCs

flow	pid	Process
4	3584	rundll32.exe
10	3768	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\034572d8a597e2758e8a97021d817b20.exe
"C:\Users\Admin\AppData\Local\Temp\034572d8a597e2758e8a97021d817b20.exe"
1⤵
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:720
- \??\c:\programdata\1321ba6d1f\bdif.exe
  c:\programdata\1321ba6d1f\bdif.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1232
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v cred /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\cred.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3692
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\cred.dll, Main
    3⤵
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Blacklisted process makes network request
    PID:3584
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v scr /t REG_SZ /d "rundll32 C:\Users\Admin\AppData\Local\Temp\scr.dll, Main"
    3⤵
    - Adds Run key to start application
    PID:3784
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\scr.dll, Main
    3⤵
    - Loads dropped DLL
    - Blacklisted process makes network request
    PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3424
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /SC HOURLY /MO 1 /TN a174c1ef10e2077451f5b6dda83242a1 /TR c:\programdata\1321ba6d1f\bdif.exe
      4⤵
      Creates scheduled task(s)
      PID:3352
- - C:\Windows\SysWOW64\REG.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d c:\programdata\1321ba6d1f
    3⤵
    PID:3160