Overview
overview
7Static
static
3bandicam-1-6-en.exe
windows7-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$TEMP/BDMP...UP.exe
windows7-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$SYSDIR/bdmjpeg.dll
windows7-x64
1$SYSDIR/bdmjpeg64.dll
windows7-x64
1$SYSDIR/bdmpega.dll
windows7-x64
1$SYSDIR/bdmpega64.dll
windows7-x64
1$SYSDIR/bdmpegv.dll
windows7-x64
1$SYSDIR/bdmpegv64.dll
windows7-x64
1$TEMP/bdfilters.dll
windows7-x64
1bdfilters.dll
windows7-x64
1bdfilters64.dll
windows7-x64
7bdcam.dll
windows7-x64
1bdcam.exe
windows7-x64
1bdcam64.exe
windows7-x64
1bdcam64.dll
windows7-x64
1bdcamih.dll
windows7-x64
1bdcap32.dll
windows7-x64
1bdcap64.dll
windows7-x64
1bdfix.exe
windows7-x64
1Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20240221-es -
resource tags
arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows -
submitted
22/02/2024, 20:50
Static task
static1
Behavioral task
behavioral1
Sample
bandicam-1-6-en.exe
Resource
win7-20240220-es
Behavioral task
behavioral2
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-es
Behavioral task
behavioral3
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20240221-es
Behavioral task
behavioral4
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240215-es
Behavioral task
behavioral5
Sample
$TEMP/BDMPEG1SETUP.exe
Resource
win7-20240221-es
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-es
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-es
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240220-es
Behavioral task
behavioral9
Sample
$SYSDIR/bdmjpeg.dll
Resource
win7-20240221-es
Behavioral task
behavioral10
Sample
$SYSDIR/bdmjpeg64.dll
Resource
win7-20240221-es
Behavioral task
behavioral11
Sample
$SYSDIR/bdmpega.dll
Resource
win7-20240221-es
Behavioral task
behavioral12
Sample
$SYSDIR/bdmpega64.dll
Resource
win7-20240221-es
Behavioral task
behavioral13
Sample
$SYSDIR/bdmpegv.dll
Resource
win7-20240221-es
Behavioral task
behavioral14
Sample
$SYSDIR/bdmpegv64.dll
Resource
win7-20240220-es
Behavioral task
behavioral15
Sample
$TEMP/bdfilters.dll
Resource
win7-20240221-es
Behavioral task
behavioral16
Sample
bdfilters.dll
Resource
win7-20240221-es
Behavioral task
behavioral17
Sample
bdfilters64.dll
Resource
win7-20240215-es
Behavioral task
behavioral18
Sample
bdcam.dll
Resource
win7-20240221-es
Behavioral task
behavioral19
Sample
bdcam.exe
Resource
win7-20240221-es
Behavioral task
behavioral20
Sample
bdcam64.exe
Resource
win7-20240221-es
Behavioral task
behavioral21
Sample
bdcam64.dll
Resource
win7-20240221-es
Behavioral task
behavioral22
Sample
bdcamih.dll
Resource
win7-20240221-es
Behavioral task
behavioral23
Sample
bdcap32.dll
Resource
win7-20240221-es
Behavioral task
behavioral24
Sample
bdcap64.dll
Resource
win7-20240221-es
Behavioral task
behavioral25
Sample
bdfix.exe
Resource
win7-20240221-es
General
-
Target
bdcam.exe
-
Size
975KB
-
MD5
907a27105e6792d926220de1d69f9a90
-
SHA1
d512f68501ace290604e4ab6f45bfd4361045301
-
SHA256
c6700c69f3430da3fe9548d116e18b312ede6746eedf24dfd20aa42b6f70e249
-
SHA512
779d5a0f41ded1cc3b6ab9d8c04d7ce4c2f5bf4207aa56ebf1ae530ac828fd6d953c9d623e815fdaddfba00c7a9da7678cfdaebe3e23e9e8d4538cae7c276a1b
-
SSDEEP
24576:eL0ijEO42ldDBr/meL/zp8EVggU9MTXg6gVni:eIO7J9/VggTTXY9i
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2348 bdcam.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2348 bdcam.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2348 bdcam.exe 2236 bdcam64.bin 2236 bdcam64.bin 2236 bdcam64.bin 2236 bdcam64.bin -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2236 2348 bdcam.exe 28 PID 2348 wrote to memory of 2236 2348 bdcam.exe 28 PID 2348 wrote to memory of 2236 2348 bdcam.exe 28 PID 2348 wrote to memory of 2236 2348 bdcam.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdcam.exe"C:\Users\Admin\AppData\Local\Temp\bdcam.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\bdcam64.bin"C:\Users\Admin\AppData\Local\Temp\bdcam64.bin"2⤵
- Suspicious use of SetWindowsHookEx
PID:2236
-