dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc

General

Target

dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
Size

92KB
MD5

7ff4b898ab66fd162f713192b6c988e0
SHA1

a7d4e8a5ee0d43f67687fc7dd7e0081c36c102b3
SHA256

dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc
SHA512

961830c0775d350adf24c0af4b9025ad442ffcec9bced1fd85bc1ce05c11b3e2b040626c1ca51a7d0db013594ec3d047757ca6397b1fd470964daeeae8e82652
SSDEEP

1536:/rT5WG67FWBMk/r2mvWh7XjNd3s3WX2o2PYFzwJOpWB8aPzeZIZAKkxTE4n0xC7Q://YL7f4r2RheSFrWB8aLe4A/xTEe0Mk

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1616	BCSSync.exe
1308	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1092 set thread context of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1616 set thread context of 1308	1616	BCSSync.exe	29

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\6mSHBnGJY.com	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1308	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1092 wrote to memory of 1612	1092	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	27
PID 1612 wrote to memory of 1616	1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	28
PID 1612 wrote to memory of 1616	1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	28
PID 1612 wrote to memory of 1616	1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	28
PID 1612 wrote to memory of 1616	1612	dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe	28
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1616 wrote to memory of 1308	1616	BCSSync.exe	29
PID 1308 wrote to memory of 532	1308	BCSSync.exe	30
PID 1308 wrote to memory of 532	1308	BCSSync.exe	30
PID 1308 wrote to memory of 532	1308	BCSSync.exe	30
PID 1308 wrote to memory of 532	1308	BCSSync.exe	30

C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
"C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
  "C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1612
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\dc4df65b49af52797af9d5097bbe317134221cc5d34ab12d96595d236f1ea2cc.exe
        5⤵
        
        PID:532

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
92KB

MD5
62169fe86501a091bfc18598e56740a8

SHA1
82e12fef487c4136e781a8e52ad7df0f7f299c1b

SHA256
a4beb4b19fa98369696064ec94029db255302143d5aadcd975495b9929cad1ac

SHA512
b606e31ae9d46f51befa3a461b6e2f80451f9c9dd7f4a6852051b2bb7f37672f4bb311c56e08a9ee5694472e1fa33a7218075b45adc3215d8b7513a3f665975e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
92KB

MD5
62169fe86501a091bfc18598e56740a8

SHA1
82e12fef487c4136e781a8e52ad7df0f7f299c1b

SHA256
a4beb4b19fa98369696064ec94029db255302143d5aadcd975495b9929cad1ac

SHA512
b606e31ae9d46f51befa3a461b6e2f80451f9c9dd7f4a6852051b2bb7f37672f4bb311c56e08a9ee5694472e1fa33a7218075b45adc3215d8b7513a3f665975e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
92KB

MD5
62169fe86501a091bfc18598e56740a8

SHA1
82e12fef487c4136e781a8e52ad7df0f7f299c1b

SHA256
a4beb4b19fa98369696064ec94029db255302143d5aadcd975495b9929cad1ac

SHA512
b606e31ae9d46f51befa3a461b6e2f80451f9c9dd7f4a6852051b2bb7f37672f4bb311c56e08a9ee5694472e1fa33a7218075b45adc3215d8b7513a3f665975e

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
92KB

MD5
62169fe86501a091bfc18598e56740a8

SHA1
82e12fef487c4136e781a8e52ad7df0f7f299c1b

SHA256
a4beb4b19fa98369696064ec94029db255302143d5aadcd975495b9929cad1ac

SHA512
b606e31ae9d46f51befa3a461b6e2f80451f9c9dd7f4a6852051b2bb7f37672f4bb311c56e08a9ee5694472e1fa33a7218075b45adc3215d8b7513a3f665975e

Download Submit
\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
92KB

MD5
62169fe86501a091bfc18598e56740a8

SHA1
82e12fef487c4136e781a8e52ad7df0f7f299c1b

SHA256
a4beb4b19fa98369696064ec94029db255302143d5aadcd975495b9929cad1ac

SHA512
b606e31ae9d46f51befa3a461b6e2f80451f9c9dd7f4a6852051b2bb7f37672f4bb311c56e08a9ee5694472e1fa33a7218075b45adc3215d8b7513a3f665975e

Download Submit
memory/1308-91-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-65-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download
memory/1612-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-64-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1612-63-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-54-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-56-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-55-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1612-94-0x0000000074431000-0x0000000074433000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing