851f52d27f15eb052fdaef1c0cdf91c9642d5b3c170a62a56c67d5b1b24d0c9f

Analysis

max time kernel
121s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8cc20031c7ce5408a3936611a30c6d10.exe
Size 452KB
Sample230112-ts4rdscd5x
SHA256 851f52d27f15eb052fdaef1c0cdf91c9642d5b3c170a62a56c67d5b1b24d0c9f
MD5 8cc20031c7ce5408a3936611a30c6d10
SHA1 621ee5c6330fb80037edf1e295216cc413251054
SHA512 b0ae960fd350887355c0fa567d82ce20b3eb01fcdcd34c0134b94042f42c862af693ebf009e89195bcfbf232a39d67573023448831b4046b21cde4e4cec8b12a
SSDEEP 6144:yYa6Lmop3BzUrbr3BcpW2p1KWeFJBlhrNW3WyssxZcr:yYpvdebrqpW2/TebBjI3jssxZcr
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

collection spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4960	bccier.exe
4444	bccier.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bccier.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bccier.exe
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bccier.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4960 set thread context of 4444	4960	bccier.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4960	bccier.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4444	bccier.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4444	bccier.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4960	4800	8cc20031c7ce5408a3936611a30c6d10.exe	82
PID 4800 wrote to memory of 4960	4800	8cc20031c7ce5408a3936611a30c6d10.exe	82
PID 4800 wrote to memory of 4960	4800	8cc20031c7ce5408a3936611a30c6d10.exe	82
PID 4960 wrote to memory of 4444	4960	bccier.exe	83
PID 4960 wrote to memory of 4444	4960	bccier.exe	83
PID 4960 wrote to memory of 4444	4960	bccier.exe	83
PID 4960 wrote to memory of 4444	4960	bccier.exe	83

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bccier.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	bccier.exe

C:\Users\Admin\AppData\Local\Temp\8cc20031c7ce5408a3936611a30c6d10.exe
"C:\Users\Admin\AppData\Local\Temp\8cc20031c7ce5408a3936611a30c6d10.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\bccier.exe
  "C:\Users\Admin\AppData\Local\Temp\bccier.exe" C:\Users\Admin\AppData\Local\Temp\gahzm.uh
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\bccier.exe
    "C:\Users\Admin\AppData\Local\Temp\bccier.exe"
    3⤵
    - Executes dropped EXE
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - outlook_office_path
    - outlook_win_path
    PID:4444

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bccier.exe

Path C:\Users\Admin\AppData\Local\Temp\bccier.exe
Size 52KB
SHA256 5363aa1e7004bb73784065ed0042f7a48301f0da81eac6d976e68d42103a1ab0
MD5 ab4561a74dc8a86d0d16ee6080e15cc0
SHA1 e31079d07d49c2e6831051ecedc791f1b333591c
SHA512 d836e4db8398493bbf2f9ad9e5004417c0c646e875c73eee207a052eef3bb73c1f58bbae9842df673d7935406c50f36cca92636fc64d95739101eb39b7d985c8
SSDEEP 768:eRWmhROsYQpVtiss8m344AAPTPLfrRs7KfB3lU9bYBhEY245fdu3NKSW+M3cS:eRWQYQ5a8l4AAfj0Y3ZBa7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

bccier.exe

Path C:\Users\Admin\AppData\Local\Temp\bccier.exe
Size 52KB
SHA256 5363aa1e7004bb73784065ed0042f7a48301f0da81eac6d976e68d42103a1ab0
MD5 ab4561a74dc8a86d0d16ee6080e15cc0
SHA1 e31079d07d49c2e6831051ecedc791f1b333591c
SHA512 d836e4db8398493bbf2f9ad9e5004417c0c646e875c73eee207a052eef3bb73c1f58bbae9842df673d7935406c50f36cca92636fc64d95739101eb39b7d985c8
SSDEEP 768:eRWmhROsYQpVtiss8m344AAPTPLfrRs7KfB3lU9bYBhEY245fdu3NKSW+M3cS:eRWQYQ5a8l4AAfj0Y3ZBa7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

bccier.exe

Path C:\Users\Admin\AppData\Local\Temp\bccier.exe
Size 52KB
SHA256 5363aa1e7004bb73784065ed0042f7a48301f0da81eac6d976e68d42103a1ab0
MD5 ab4561a74dc8a86d0d16ee6080e15cc0
SHA1 e31079d07d49c2e6831051ecedc791f1b333591c
SHA512 d836e4db8398493bbf2f9ad9e5004417c0c646e875c73eee207a052eef3bb73c1f58bbae9842df673d7935406c50f36cca92636fc64d95739101eb39b7d985c8
SSDEEP 768:eRWmhROsYQpVtiss8m344AAPTPLfrRs7KfB3lU9bYBhEY245fdu3NKSW+M3cS:eRWQYQ5a8l4AAfj0Y3ZBa7S
MD5 SHA1 SHA512 SSDEEP

Submit Download

btbpuozlnvj.v

Path C:\Users\Admin\AppData\Local\Temp\btbpuozlnvj.v
Size 262KB
SHA256 fbf2087cfe854de5417869cf8fb490f2b8fe1d514051a08f36753d0666e3780a
MD5 0c7971df57a2be534cdd27dd18b4fbfb
SHA1 25325f3562719ede0df938b52855aea31ef42c31
SHA512 20b180bf17b7e1453c6e549c620102f70b6f26c961c13befb55b54e218c4cf52968264782401fcfa5955b7dc2fd43fa90440bf69323b1c14271eb15b11061bf3
SSDEEP 6144:DzHOsaF3xewU2P3oHmna3seM2FYuSa0t9znG5I/:nHOf3ToGnYvz+nMI/
MD5 SHA1 SHA512 SSDEEP

Submit Download

gahzm.uh

Path C:\Users\Admin\AppData\Local\Temp\gahzm.uh
Size 6KB
SHA256 1be70bd69a0734c6eab828e54775c5ff7adbcb1a0013b830caedfdc275887543
MD5 3a5618df74aadf2f8640c642db9de217
SHA1 f60801ddb5ffca0f107ea2c7aadca9b08a77dc83
SHA512 5e5f460d5cdbacf3cbb69bed10903380daf1a2f105369f5c5b8ed5c75fe201bc0e7e3996801bb4b467033669b92c43f6d81656b0ab08602db4f2618b5f5fff8e
SSDEEP 96:Farc6oYAg/DrYuck2XO5oSwsYcWVfWIncdxr/D7bAEFRhqwbJz7gNQQXzL2gf:FarcRIkhX1ShDSfjnsxr/HpDVNoIgf
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4444-139-0x0000000000400000-0x0000000000441000-memory.dmp

Download

memory/4444-140-0x0000000004B60000-0x0000000005104000-memory.dmp

Download

memory/4444-141-0x00000000049E0000-0x0000000004A46000-memory.dmp

Download

memory/4444-142-0x0000000005780000-0x0000000005812000-memory.dmp

Download

memory/4444-143-0x00000000059C0000-0x00000000059CA000-memory.dmp

Download

memory/4444-144-0x00000000055D0000-0x0000000005620000-memory.dmp

Download

memory/4444-145-0x0000000005C30000-0x0000000005DF2000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads