68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d

General

Target

68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe
Size

62KB
MD5

a020acd9672a90dc2b86cb037cb67dd0
SHA1

a4f13efe5d0874bbe25e3639325ee47f57258356
SHA256

68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d
SHA512

c577c6dba72c7dae0975beccd45fdbd58084055705c212c2d833002a63c15d892b670b3c5380a13385d55bb2e84a86214d81d1131132b04d9216adfcb34abd8a
SSDEEP

1536:V58Ib8heU7Oqa1t7uQoSUvzlPCyhdH3lSaajFx8CEIgxT2:VyQaeNRf7uQovv5PCy7lZiFvcxT

Score

8^/10

aspackv2 persistence

Malware Config

Signatures

ASPack v2.12-2.42 2 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00140000000054ab-56.dat	aspack_v212_v242
behavioral1/files/0x00140000000054ab-58.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
1240	BDQX.EXE
1552	BDQX.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\C:\ = "C:\\Windows\\BDQX.EXE"	IPCONFIG.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\C:\ = "C:\\Windows\\BDQX.EXE"	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1240 set thread context of 1660	1240	BDQX.EXE	29

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BDQX.EXE	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe
File created	C:\Windows\BDQX.EXE	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe
File opened for modification	C:\Windows\BDQX.EXE	IPCONFIG.EXE

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1660	IPCONFIG.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 1240	1948	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe	28
PID 1948 wrote to memory of 1240	1948	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe	28
PID 1948 wrote to memory of 1240	1948	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe	28
PID 1948 wrote to memory of 1240	1948	68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe	28
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1240 wrote to memory of 1660	1240	BDQX.EXE	29
PID 1660 wrote to memory of 1552	1660	IPCONFIG.EXE	30
PID 1660 wrote to memory of 1552	1660	IPCONFIG.EXE	30
PID 1660 wrote to memory of 1552	1660	IPCONFIG.EXE	30
PID 1660 wrote to memory of 1552	1660	IPCONFIG.EXE	30

C:\Users\Admin\AppData\Local\Temp\68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe
"C:\Users\Admin\AppData\Local\Temp\68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Windows\BDQX.EXE
  C:\Windows\BDQX.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\SysWOW64\IPCONFIG.EXE
    C:\Windows\SYSTEM32\IPCONFIG.EXE
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Gathers network information
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows\BDQX.EXE
      C:\Windows\BDQX.EXE
      4⤵
      Executes dropped EXE
      PID:1552

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

1

T1059

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\BDQX.EXE

Filesize
62KB

MD5
a020acd9672a90dc2b86cb037cb67dd0

SHA1
a4f13efe5d0874bbe25e3639325ee47f57258356

SHA256
68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d

SHA512
c577c6dba72c7dae0975beccd45fdbd58084055705c212c2d833002a63c15d892b670b3c5380a13385d55bb2e84a86214d81d1131132b04d9216adfcb34abd8a

Download Submit
C:\Windows\BDQX.EXE

Filesize
62KB

MD5
a020acd9672a90dc2b86cb037cb67dd0

SHA1
a4f13efe5d0874bbe25e3639325ee47f57258356

SHA256
68e1853307b7d2412013364f9d2c712b6b9602d82cd64482ccc2c5f0cf6c4b6d

SHA512
c577c6dba72c7dae0975beccd45fdbd58084055705c212c2d833002a63c15d892b670b3c5380a13385d55bb2e84a86214d81d1131132b04d9216adfcb34abd8a

Download Submit
C:\Windows\BDQX.EXE

Filesize
26KB

MD5
cabb20e171770ff64614a54c1f31c033

SHA1
ea18043fedaf888f04c07f71f2006f3f479c0b41

SHA256
c0e3087d87c84776fe7ffca768a0793c02d28e34a821f0c9da32339af8e7e6a6

SHA512
a6a6beff693f2e2c71c0d8e12f6964e789aa4b370c1e0191b2b0ff038801fdb0038a54c0a8f2dbc0d399d2c016f89701c6b6275b3a2b6fa74fb2a5ea817c2d3b

Download Submit
memory/1240-63-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1660-64-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1660-67-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1660-70-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1660-61-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1660-59-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download
memory/1948-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1948-65-0x0000000010000000-0x0000000010029000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing