5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c

General

Target

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
Size

81KB
MD5

a6f154313a388ef98c3057480e5ab0ce
SHA1

66a31cf5b42ac12b3fd7e2b56bea9d436bb8a5f5
SHA256

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c
SHA512

5b4a67a83746f1b7e67ed41f2c14ffe66580a6187c9e34d5d0efb2146a846cd32504a30da8f37fbdb291738a7f3770a5ab56372c6c84201c6eb24b0d200f83db
SSDEEP

1536:AZtB3QtVbDkyJooi5TJc99v34PQEc4PpSo4oAWX76DfNNELk645jf:Af3QtVHkyCy9xIoGpxMWrgbj5z

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BCSSync.exe"	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BCSSync.exe"	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1628-64-0x0000000000400000-0x0000000000410000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "C:\\Users\\Admin\\AppData\\Local\\Temp\\BCSSync.exe"	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	pid	process	target process
PID 1628 set thread context of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

pid	process
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
852	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

description	pid	process	target process
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
PID 1628 wrote to memory of 852	1628	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe	5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe

C:\Users\Admin\AppData\Local\Temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
"C:\Users\Admin\AppData\Local\Temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1628

\??\c:\users\admin\appdata\local\temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe
"c:\users\admin\appdata\local\temp\5d8e806ab999db99e095d3d1b6322a4e21934b4cf8b2456a8ba011009c0b7b3c.exe"
2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/852-61-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-54-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-57-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-58-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-59-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-60-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-55-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-62-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-68-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-65-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-63-0x000000000040D3A0-mapping.dmp

Download
memory/852-66-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/852-67-0x0000000000400000-0x0000000000415000-memory.dmp

Filesize
84KB

Download
memory/1628-64-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads