a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd

General

Target

a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
Size

37KB
MD5

705dd8ca51dd67a5387469ea2d5bb299
SHA1

7a9fe18398025107b8329853f1ee965c63c9fce5
SHA256

a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd
SHA512

1786817600c77bc8abfcea5c54ea3b55a99745f9f9c385916d92f89d604879110406252b8ea15c591d2a6259db4a168caf21b0ae0d125e32f0c1c6a074e4632b
SSDEEP

768:jpuxbbb93pfzxWt7QYQ8IgDidhHPjAJYvHF0lwY437avXKrnrE:j0Rbb5WRQYt9ir/2wraT

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1196	BCSSync.exe
1724	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe

Unexpected DNS network traffic destination 7 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1072 set thread context of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1196 set thread context of 1724	1196	BCSSync.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\8k2o44.com	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	BCSSync.exe
1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1072 wrote to memory of 1504	1072	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	27
PID 1504 wrote to memory of 1196	1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	28
PID 1504 wrote to memory of 1196	1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	28
PID 1504 wrote to memory of 1196	1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	28
PID 1504 wrote to memory of 1196	1504	a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe	28
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1196 wrote to memory of 1724	1196	BCSSync.exe	29
PID 1724 wrote to memory of 1872	1724	BCSSync.exe	30
PID 1724 wrote to memory of 1872	1724	BCSSync.exe	30
PID 1724 wrote to memory of 1872	1724	BCSSync.exe	30
PID 1724 wrote to memory of 1872	1724	BCSSync.exe	30

C:\Users\Admin\AppData\Local\Temp\a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
"C:\Users\Admin\AppData\Local\Temp\a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Users\Admin\AppData\Local\Temp\a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
  C:\Users\Admin\AppData\Local\Temp\a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\a1bc30ae56247a8a7c924b8c04284359c24466b1e14d70fdeb91eb2fcc2700bd.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1196
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1724
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
        5⤵
        
        PID:1872

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
f2abea4360f2ebfc3421c2c501ddf37d

SHA1
20b3267834f530c46f3c29ecbf7ccb799e19a94b

SHA256
e16f0a616d3b1a0b0b352d8dd77a186d538c0ebca5905c771bd9e76e3ed0dd12

SHA512
4ac57083758e54af8e909d7e9a7fc2e6216775539b74f9c267c62e0e99b32073d5319f7bf536f8c0fd128d8422ea72ff422f670d6add09dcd954501c8f6a89c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
f2abea4360f2ebfc3421c2c501ddf37d

SHA1
20b3267834f530c46f3c29ecbf7ccb799e19a94b

SHA256
e16f0a616d3b1a0b0b352d8dd77a186d538c0ebca5905c771bd9e76e3ed0dd12

SHA512
4ac57083758e54af8e909d7e9a7fc2e6216775539b74f9c267c62e0e99b32073d5319f7bf536f8c0fd128d8422ea72ff422f670d6add09dcd954501c8f6a89c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
f2abea4360f2ebfc3421c2c501ddf37d

SHA1
20b3267834f530c46f3c29ecbf7ccb799e19a94b

SHA256
e16f0a616d3b1a0b0b352d8dd77a186d538c0ebca5905c771bd9e76e3ed0dd12

SHA512
4ac57083758e54af8e909d7e9a7fc2e6216775539b74f9c267c62e0e99b32073d5319f7bf536f8c0fd128d8422ea72ff422f670d6add09dcd954501c8f6a89c7

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
f2abea4360f2ebfc3421c2c501ddf37d

SHA1
20b3267834f530c46f3c29ecbf7ccb799e19a94b

SHA256
e16f0a616d3b1a0b0b352d8dd77a186d538c0ebca5905c771bd9e76e3ed0dd12

SHA512
4ac57083758e54af8e909d7e9a7fc2e6216775539b74f9c267c62e0e99b32073d5319f7bf536f8c0fd128d8422ea72ff422f670d6add09dcd954501c8f6a89c7

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
f2abea4360f2ebfc3421c2c501ddf37d

SHA1
20b3267834f530c46f3c29ecbf7ccb799e19a94b

SHA256
e16f0a616d3b1a0b0b352d8dd77a186d538c0ebca5905c771bd9e76e3ed0dd12

SHA512
4ac57083758e54af8e909d7e9a7fc2e6216775539b74f9c267c62e0e99b32073d5319f7bf536f8c0fd128d8422ea72ff422f670d6add09dcd954501c8f6a89c7

Download Submit
memory/1196-84-0x0000000000508000-0x0000000000519000-memory.dmp

Filesize
68KB

Download
memory/1504-73-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-78-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-79-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-76-0x0000000075A81000-0x0000000075A83000-memory.dmp

Filesize
8KB

Download
memory/1504-67-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-77-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-71-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-70-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1504-102-0x0000000074311000-0x0000000074313000-memory.dmp

Filesize
8KB

Download
memory/1504-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-98-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1724-101-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download

Analysis

Sharing