Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16-10-2023 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Birdman/Birdman.dll
Resource
win7-20230831-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Birdman/Birdman.dll
Resource
win10v2004-20230915-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral3
Sample
Birdman/TZZ.pdf.lnk
Resource
win7-20230831-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
Birdman/TZZ.pdf.lnk
Resource
win10v2004-20230915-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
Birdman/Birdman.dll
-
Size
1.8MB
-
MD5
ec8db58467d8e2e2221635c592fcca1a
-
SHA1
e0215d156d2dc59b6259fd5ff792dc740626c8fa
-
SHA256
aebff5134e07a1586b911271a49702c8623b8ac8da2c135d4d3b0145a826f507
-
SHA512
5aaf241388dbb343e059af4a0cfd4d7507189f0c94f415ba9b9d87791e5f2bf81a780f73e2bbc8bb39f90edc779987eb422192fb3facb4c0dae78c140cacb787
-
SSDEEP
24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J
Score
5/10
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4832 set thread context of 4164 4832 rundll32.exe 84 -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4400 ipconfig.exe 2464 netstat.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4164 SearchProtocolHost.exe 4164 SearchProtocolHost.exe 4164 SearchProtocolHost.exe 4164 SearchProtocolHost.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 4832 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 1824 whoami.exe Token: SeDebugPrivilege 2464 netstat.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 4832 1584 rundll32.exe 81 PID 1584 wrote to memory of 4832 1584 rundll32.exe 81 PID 1584 wrote to memory of 4832 1584 rundll32.exe 81 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84 PID 4832 wrote to memory of 4164 4832 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\Birdman\Birdman.dll,#12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4164 -
C:\Windows\SysWOW64\whoami.exewhoami.exe /all4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1824
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig.exe /all4⤵
- Gathers network information
PID:4400
-
-
C:\Windows\SysWOW64\netstat.exenetstat.exe -aon4⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
-