d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98

Analysis

max time kernel
154s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
06-12-2022 21:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe
Size

58KB
MD5

e19ca08e1169ca29f522b4ca1d63c605
SHA1

b276d3456c7e5394bfb4813ef8e32f0c75acbef1
SHA256

d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98
SHA512

bb19c9fd255c0e96adab17943baa4cfabdd7a727af50663b5a91b4977540c1f4f024256d75b575d889a5c5e3dac6efa5b69ca6d8f6e59c12fe8a26f17802f306
SSDEEP

768:1EM8Ja7ikMLQr7nPdUNvdqSvynEm7uIucUqjy9Wta0OEoILJp9GdaX5qoQSTri1x:Onq91UN4bEmLUqjVO6LJNXUoliHR

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4628	BDQX_Beta5.EXE

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\BDX = "C:\\Windows\\BDQX_Beta5.EXE"	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4628 set thread context of 728	4628	BDQX_Beta5.EXE	80

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\BDQX_Beta5.EXE	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe
File created	C:\Windows\BDQX_Beta5.EXE	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4824	728	WerFault.exe	80

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
728	IPCONFIG.EXE

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 4628	1544	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe	79
PID 1544 wrote to memory of 4628	1544	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe	79
PID 1544 wrote to memory of 4628	1544	d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe	79
PID 4628 wrote to memory of 728	4628	BDQX_Beta5.EXE	80
PID 4628 wrote to memory of 728	4628	BDQX_Beta5.EXE	80
PID 4628 wrote to memory of 728	4628	BDQX_Beta5.EXE	80
PID 4628 wrote to memory of 728	4628	BDQX_Beta5.EXE	80
PID 4628 wrote to memory of 728	4628	BDQX_Beta5.EXE	80

C:\Users\Admin\AppData\Local\Temp\d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe
"C:\Users\Admin\AppData\Local\Temp\d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Windows\BDQX_Beta5.EXE
  C:\Windows\BDQX_Beta5.EXE
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\IPCONFIG.EXE
    C:\Windows\SYSTEM32\IPCONFIG.EXE
    3⤵
    - Gathers network information
    PID:728
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 512
      4⤵
      Program crash
      PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 728 -ip 728
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\BDQX_Beta5.EXE

Filesize
58KB

MD5
e19ca08e1169ca29f522b4ca1d63c605

SHA1
b276d3456c7e5394bfb4813ef8e32f0c75acbef1

SHA256
d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98

SHA512
bb19c9fd255c0e96adab17943baa4cfabdd7a727af50663b5a91b4977540c1f4f024256d75b575d889a5c5e3dac6efa5b69ca6d8f6e59c12fe8a26f17802f306

Download Submit
C:\Windows\BDQX_Beta5.EXE

Filesize
58KB

MD5
e19ca08e1169ca29f522b4ca1d63c605

SHA1
b276d3456c7e5394bfb4813ef8e32f0c75acbef1

SHA256
d860eb911b8009a5552a400e23b47dc36788e11f3f1e0ec94097ca28fb4cbe98

SHA512
bb19c9fd255c0e96adab17943baa4cfabdd7a727af50663b5a91b4977540c1f4f024256d75b575d889a5c5e3dac6efa5b69ca6d8f6e59c12fe8a26f17802f306

Download Submit
memory/728-135-0x0000000000000000-mapping.dmp

Download
memory/728-136-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/728-137-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/728-138-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/728-139-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/728-140-0x0000000010000000-0x0000000010028000-memory.dmp

Filesize
160KB

Download
memory/4628-132-0x0000000000000000-mapping.dmp

Download