Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2024, 15:18

General

  • Target

    Bandicam/bdcam_setup.bat

  • Size

    61KB

  • MD5

    04c9207727dc5474f2deb587e591881b

  • SHA1

    c7217d5a6992ed4b258cfe4e0689b15e37077d0f

  • SHA256

    b9fec10884cff054689605514294b72870bebf085eebedfd8555123127688272

  • SHA512

    44827e60c68a8dc572f9fe1e35a1a32cd56a5fbcfd8d85344c309daf60ef233995a2353e776e648706430f60ac4eeddb53a40cd13ad53f28e4ac23d6d0df87cd

  • SSDEEP

    1536:7Ysjgm7LaXhXOXn3IXsz/oeQWewbUZHDjY9:7EXheZz/oel2ZHHc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Modifies registry class 10 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam_setup.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3980
    • C:\Windows\system32\net.exe
      NET SESSION
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 SESSION
        3⤵
          PID:1468
      • C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam.exe
        "bdcam.exe" /install
        2⤵
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1028
        • C:\Windows\system32\rundll32.exe
          "C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcamvk64.dll",RegDll
          3⤵
            PID:2740
          • C:\Windows\SysWOW64\rundll32.exe
            "C:\Windows\SysWOW64\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcamvk32.dll",RegDll
            3⤵
              PID:2928
          • C:\Windows\system32\certutil.exe
            certutil -decode C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam_setup.bat "C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe"
            2⤵
              PID:3268
            • C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe
              "C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe" /inst
              2⤵
              • Executes dropped EXE
              PID:4108
            • C:\Windows\system32\reg.exe
              reg copy "HKLM\SOFTWARE\WOW6432Node\BANDISOFT\BANDICAM\OPTION" "HKCU\SOFTWARE\BANDISOFT\BANDICAM\OPTION" /s /f
              2⤵
                PID:2168
              • C:\Users\Admin\AppData\Local\Temp\Bandicam\bdcam.exe
                "bdcam.exe"
                2⤵
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:2460
            • C:\Windows\system32\AUDIODG.EXE
              C:\Windows\system32\AUDIODG.EXE 0x50c 0x4b0
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3408

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\bdcam_activate.exe

              Filesize

              45KB

              MD5

              360ec335cff3d6f6242b62f96747c6c1

              SHA1

              60439d9b7689b994b1691db6f2d795697eeafa48

              SHA256

              20d7107252aac741c68b8a03cc20520430e93acdbe3434ee428d162a85f93a94

              SHA512

              ee9aa23d4e7600fe2d57350a483125d6e22ee73718d362d061a20b0b096bc874f864328d8be38b5b20768ecca77ea36f8ea5f7a25ad11fca3ba862fe736eeef0

            • memory/1028-0-0x00007FF7C822B000-0x00007FF7C8668000-memory.dmp

              Filesize

              4.2MB

            • memory/1028-1-0x00007FFB3FBD0000-0x00007FFB3FBD2000-memory.dmp

              Filesize

              8KB

            • memory/1028-2-0x00007FF7C7C70000-0x00007FF7C89D2000-memory.dmp

              Filesize

              13.4MB

            • memory/1028-3-0x00007FF7C822B000-0x00007FF7C8668000-memory.dmp

              Filesize

              4.2MB

            • memory/2460-10-0x00007FF7C7C70000-0x00007FF7C89D2000-memory.dmp

              Filesize

              13.4MB

            • memory/4108-8-0x0000000000400000-0x0000000000413000-memory.dmp

              Filesize

              76KB