bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f

General

Target
bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
Size 830KB
Sample220326-bazevabbgm
SHA256 bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f
MD5 b51cbeb5ee05671cf0ef8a5f7d81a1e4
SHA1 cf8bb65a7a32021365a562d045aad430b76eca6d
SHA512 6b1a7c27b3a9fd06c46545287ab599afa6cd89a9a7ee543d01239d5ee61382a97de2212aac6ed160321b9ec8bbe1a69e5218817eee0714b0d6db8a65d5249492
MD5 SHA1 SHA512

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3736 set thread context of 3828	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	89

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
824	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
1856	powershell.exe
1856	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
Token: SeDebugPrivilege	1856	powershell.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 2452	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	88
PID 3736 wrote to memory of 2452	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	88
PID 3736 wrote to memory of 2452	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	88
PID 3736 wrote to memory of 3828	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	89
PID 3736 wrote to memory of 3828	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	89
PID 3736 wrote to memory of 3828	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	89
PID 3736 wrote to memory of 3828	3736	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	89
PID 2452 wrote to memory of 824	2452	cmd.exe	90
PID 2452 wrote to memory of 824	2452	cmd.exe	90
PID 2452 wrote to memory of 824	2452	cmd.exe	90
PID 3828 wrote to memory of 1856	3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	96
PID 3828 wrote to memory of 1856	3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	96
PID 3828 wrote to memory of 1856	3828	bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe	96

C:\Users\Admin\AppData\Local\Temp\bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
"C:\Users\Admin\AppData\Local\Temp\bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3d5b5cf62fb348a1997d8acab32e4735.xml"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\3d5b5cf62fb348a1997d8acab32e4735.xml"
    3⤵
    - Creates scheduled task(s)
    PID:824
- C:\Users\Admin\AppData\Local\Temp\bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe
  "C:\Users\Admin\AppData\Local\Temp\bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "powershell" Start-Sleep -Seconds 2; Remove-Item -path 'C:\Users\Admin\AppData\Local\Temp\bd335f371ed1487e578ed7e8227648ff0e28d2d7c7e205d8d1e62ca39b83229f.exe'
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1856

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-146-0x0000000006410000-0x000000000642E000-memory.dmp

Download

memory/1856-147-0x0000000002AA5000-0x0000000002AA7000-memory.dmp

Download

memory/1856-151-0x0000000006A70000-0x0000000006A92000-memory.dmp

Download

memory/1856-150-0x0000000007720000-0x00000000077B6000-memory.dmp

Download

memory/1856-149-0x0000000006990000-0x00000000069AA000-memory.dmp

Download

memory/1856-142-0x0000000002AF0000-0x0000000002B26000-memory.dmp

Download

memory/1856-143-0x00000000054F0000-0x0000000005B18000-memory.dmp

Download

memory/1856-144-0x0000000005460000-0x0000000005482000-memory.dmp

Download

memory/1856-145-0x0000000005D50000-0x0000000005DB6000-memory.dmp

Download

memory/1856-148-0x0000000007D00000-0x000000000837A000-memory.dmp

Download

memory/3828-140-0x00000000055D0000-0x0000000005636000-memory.dmp

Download

memory/3828-139-0x0000000005EE0000-0x0000000006484000-memory.dmp

Download

memory/3828-138-0x0000000005890000-0x0000000005922000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads