Overview
overview
5Static
static
3BDCAMSETUP...85.exe
windows7-x64
5BDCAMSETUP...85.exe
windows10-2004-x64
5$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$SYSDIR/D3...47.dll
windows10-2004-x64
3$SYSDIR/vcomp140.dll
windows7-x64
3$SYSDIR/vcomp140.dll
windows10-2004-x64
3$TEMP/BDMP...UP.exe
windows7-x64
5$TEMP/BDMP...UP.exe
windows10-2004-x64
5$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$SYSDIR/bdmjpeg.dll
windows7-x64
3$SYSDIR/bdmjpeg.dll
windows10-2004-x64
3$SYSDIR/bdmjpeg64.dll
windows7-x64
1$SYSDIR/bdmjpeg64.dll
windows10-2004-x64
1$SYSDIR/bdmpega.dll
windows7-x64
3$SYSDIR/bdmpega.dll
windows10-2004-x64
3$SYSDIR/bdmpega64.dll
windows7-x64
1$SYSDIR/bdmpega64.dll
windows10-2004-x64
1$SYSDIR/bdmpegv.dll
windows7-x64
3$SYSDIR/bdmpegv.dll
windows10-2004-x64
3RegVulkanLayer.bat
windows7-x64
3RegVulkanLayer.bat
windows10-2004-x64
3UnregVulkanLayer.bat
windows7-x64
3UnregVulkanLayer.bat
windows10-2004-x64
3amf-compon...32.dll
windows7-x64
3Analysis
-
max time kernel
93s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13/10/2024, 11:50 UTC
Static task
static1
Behavioral task
behavioral1
Sample
BDCAMSETUP_ENG_4_1_2_1385.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
BDCAMSETUP_ENG_4_1_2_1385.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$SYSDIR/D3DCompiler_47.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral8
Sample
$SYSDIR/vcomp140.dll
Resource
win7-20240903-en
Behavioral task
behavioral9
Sample
$SYSDIR/vcomp140.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral10
Sample
$TEMP/BDMPEG1SETUP.exe
Resource
win7-20240903-en
Behavioral task
behavioral11
Sample
$TEMP/BDMPEG1SETUP.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20241010-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240729-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral18
Sample
$SYSDIR/bdmjpeg.dll
Resource
win7-20240708-en
Behavioral task
behavioral19
Sample
$SYSDIR/bdmjpeg.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral20
Sample
$SYSDIR/bdmjpeg64.dll
Resource
win7-20240903-en
Behavioral task
behavioral21
Sample
$SYSDIR/bdmjpeg64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral22
Sample
$SYSDIR/bdmpega.dll
Resource
win7-20240708-en
Behavioral task
behavioral23
Sample
$SYSDIR/bdmpega.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral24
Sample
$SYSDIR/bdmpega64.dll
Resource
win7-20240903-en
Behavioral task
behavioral25
Sample
$SYSDIR/bdmpega64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral26
Sample
$SYSDIR/bdmpegv.dll
Resource
win7-20241010-en
Behavioral task
behavioral27
Sample
$SYSDIR/bdmpegv.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral28
Sample
RegVulkanLayer.bat
Resource
win7-20240708-en
Behavioral task
behavioral29
Sample
RegVulkanLayer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral30
Sample
UnregVulkanLayer.bat
Resource
win7-20240903-en
Behavioral task
behavioral31
Sample
UnregVulkanLayer.bat
Resource
win10v2004-20241007-en
Behavioral task
behavioral32
Sample
amf-component-vce-windesktop32.dll
Resource
win7-20241010-en
General
-
Target
$PLUGINSDIR/InstallOptions.dll
-
Size
15KB
-
MD5
67d8f4d5acdb722e9cb7a99570b3ded1
-
SHA1
f4a729ba77332325ea4dbdeea98b579f501fd26f
-
SHA256
fa8de036b1d9bb06be383a82041966c73473fc8382d041fb5c1758f991afeae7
-
SHA512
03999cc26a76b0de6f7e4e8a45137ee4d9c250366ac5a458110f00f7962158311eea5f22d3ee4f32f85aa6969eb143bdb8f03ca989568764ed2bc488c89b4b7f
-
SSDEEP
192:CsIZHdT9uwYX94kYd2iCzHR+yK7imphLAykycpKPd5m78ozxGUWumle:CsUHd9GN2d2iwl0impATIPdA78Ov6
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 1444 4064 WerFault.exe 84 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3388 wrote to memory of 4064 3388 rundll32.exe 84 PID 3388 wrote to memory of 4064 3388 rundll32.exe 84 PID 3388 wrote to memory of 4064 3388 rundll32.exe 84
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\InstallOptions.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 6363⤵
- Program crash
PID:1444
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4064 -ip 40641⤵PID:1968
Network
-
Remote address:8.8.8.8:53Requestg.bing.comIN AResponseg.bing.comIN CNAMEg-bing-com.ax-0001.ax-msedge.netg-bing-com.ax-0001.ax-msedge.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=Remote address:150.171.27.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MUID=1F593FB38C9E644206892AA48D986515; domain=.bing.com; expires=Fri, 07-Nov-2025 11:50:49 GMT; path=/; SameSite=None; Secure; Priority=High;
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0AB85A442B46409F96B5BA8B6418308D Ref B: LON601060107036 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=Remote address:150.171.27.10:443RequestGET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1F593FB38C9E644206892AA48D986515
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
set-cookie: MSPTC=w5zh5B5zfcL_HL70h49jpYjaQG_McTDV1uCJpeUWccs; domain=.bing.com; expires=Fri, 07-Nov-2025 11:50:49 GMT; path=/; Partitioned; secure; SameSite=None
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7CEFA1E5A8774938B396D397C367F344 Ref B: LON601060107036 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
GEThttps://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=Remote address:150.171.27.10:443RequestGET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid= HTTP/2.0
host: g.bing.com
accept-encoding: gzip, deflate
user-agent: WindowsShellClient/9.0.40929.0 (Windows)
cookie: MUID=1F593FB38C9E644206892AA48D986515; MSPTC=w5zh5B5zfcL_HL70h49jpYjaQG_McTDV1uCJpeUWccs
ResponseHTTP/2.0 204
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
access-control-allow-origin: *
x-cache: CONFIG_NOCACHE
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: FA21ADE5BBCF4B6494AD45189C6113E8 Ref B: LON601060107036 Ref C: 2024-10-13T11:50:49Z
date: Sun, 13 Oct 2024 11:50:48 GMT
-
Remote address:8.8.8.8:53Request8.8.8.8.in-addr.arpaIN PTRResponse8.8.8.8.in-addr.arpaIN PTRdnsgoogle
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request50.23.12.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.210.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request0.205.248.87.in-addr.arpaIN PTRResponse0.205.248.87.in-addr.arpaIN PTRhttps-87-248-205-0lgwllnwnet
-
Remote address:8.8.8.8:53Request19.229.111.52.in-addr.arpaIN PTRResponse
-
150.171.27.10:443https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=tls, http22.0kB 9.4kB 22 19
HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=HTTP Response
204HTTP Request
GET https://g.bing.com/neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=6cf3a844093e48e7b4415ff8901ca1f2&localId=w:54ECD007-E294-A159-E37D-CA55023ED6B0&deviceId=6966572651497155&anid=HTTP Response
204
-
56 B 148 B 1 1
DNS Request
g.bing.com
DNS Response
150.171.27.10150.171.28.10
-
66 B 90 B 1 1
DNS Request
8.8.8.8.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
70 B 156 B 1 1
DNS Request
50.23.12.20.in-addr.arpa
-
72 B 146 B 1 1
DNS Request
15.164.165.52.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.210.232.199.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
71 B 116 B 1 1
DNS Request
0.205.248.87.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
19.229.111.52.in-addr.arpa