Analysis

  • max time kernel
    121s
  • max time network
    127s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    13/06/2024, 15:18

General

  • Target

    Bandicam/bdcam_setup.bat

  • Size

    61KB

  • MD5

    04c9207727dc5474f2deb587e591881b

  • SHA1

    c7217d5a6992ed4b258cfe4e0689b15e37077d0f

  • SHA256

    b9fec10884cff054689605514294b72870bebf085eebedfd8555123127688272

  • SHA512

    44827e60c68a8dc572f9fe1e35a1a32cd56a5fbcfd8d85344c309daf60ef233995a2353e776e648706430f60ac4eeddb53a40cd13ad53f28e4ac23d6d0df87cd

  • SSDEEP

    1536:7Ysjgm7LaXhXOXn3IXsz/oeQWewbUZHDjY9:7EXheZz/oel2ZHHc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Modifies registry class 10 IoCs
  • Runs net.exe
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam_setup.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2104
    • C:\Windows\system32\net.exe
      NET SESSION
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:552
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 SESSION
        3⤵
          PID:1160
      • C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam.exe
        "bdcam.exe" /install
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1188
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcamvk64.dll",RegDll
          3⤵
            PID:2568
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcamvk32.dll",RegDll
            3⤵
              PID:2628
          • C:\Windows\system32\certutil.exe
            certutil -decode C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam_setup.bat "C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe"
            2⤵
              PID:2648
            • C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe
              "C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe" /inst
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: CmdExeWriteProcessMemorySpam
              PID:2668
            • C:\Windows\system32\reg.exe
              reg copy "HKLM\SOFTWARE\WOW6432Node\BANDISOFT\BANDICAM\OPTION" "HKCU\SOFTWARE\BANDISOFT\BANDICAM\OPTION" /s /f
              2⤵
                PID:2596
              • C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam.exe
                "bdcam.exe"
                2⤵
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2264

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

              Filesize

              70KB

              MD5

              49aebf8cbd62d92ac215b2923fb1b9f5

              SHA1

              1723be06719828dda65ad804298d0431f6aff976

              SHA256

              b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

              SHA512

              bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            • C:\Users\Admin\AppData\Local\Temp\Tar41E7.tmp

              Filesize

              181KB

              MD5

              4ea6026cf93ec6338144661bf1202cd1

              SHA1

              a1dec9044f750ad887935a01430bf49322fbdcb7

              SHA256

              8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

              SHA512

              6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            • C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe

              Filesize

              45KB

              MD5

              360ec335cff3d6f6242b62f96747c6c1

              SHA1

              60439d9b7689b994b1691db6f2d795697eeafa48

              SHA256

              20d7107252aac741c68b8a03cc20520430e93acdbe3434ee428d162a85f93a94

              SHA512

              ee9aa23d4e7600fe2d57350a483125d6e22ee73718d362d061a20b0b096bc874f864328d8be38b5b20768ecca77ea36f8ea5f7a25ad11fca3ba862fe736eeef0

            • memory/1188-6-0x000000013F720000-0x0000000140482000-memory.dmp

              Filesize

              13.4MB

            • memory/1188-0-0x000000013FCDB000-0x0000000140118000-memory.dmp

              Filesize

              4.2MB

            • memory/1188-7-0x000000013FCDB000-0x0000000140118000-memory.dmp

              Filesize

              4.2MB

            • memory/1188-5-0x0000000077D60000-0x0000000077D62000-memory.dmp

              Filesize

              8KB

            • memory/1188-3-0x0000000077D60000-0x0000000077D62000-memory.dmp

              Filesize

              8KB

            • memory/1188-1-0x0000000077D60000-0x0000000077D62000-memory.dmp

              Filesize

              8KB

            • memory/2264-19-0x0000000000250000-0x000000000025A000-memory.dmp

              Filesize

              40KB

            • memory/2264-18-0x0000000000250000-0x000000000025A000-memory.dmp

              Filesize

              40KB

            • memory/2264-17-0x000000013F3F0000-0x0000000140152000-memory.dmp

              Filesize

              13.4MB

            • memory/2264-16-0x0000000077D60000-0x0000000077D62000-memory.dmp

              Filesize

              8KB

            • memory/2264-63-0x0000000000250000-0x000000000025A000-memory.dmp

              Filesize

              40KB

            • memory/2264-64-0x0000000000250000-0x000000000025A000-memory.dmp

              Filesize

              40KB

            • memory/2264-65-0x0000000000250000-0x000000000025A000-memory.dmp

              Filesize

              40KB

            • memory/2668-11-0x0000000000400000-0x0000000000413000-memory.dmp

              Filesize

              76KB