6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BC32.bin.exe
Size 1.8MB
Sample230719-d5w93sfe85
SHA256 6fa95e4e25eb2cf60595af08ca20573f260e87b40a8202bbcfeb439634f0aeb6
MD5 b15a0e59e709856f57c011a4110fae6b
SHA1 53b9ba00065d07992fab361316441de49eda1626
SHA512 f79f92a8f6bbdb7902f676f712ebfb61ffc0ba14020c09bf397ea1ce56fc17f64227a345c61d0e63de51fe27d828c7d8961ed9026a556efe4815a9661e7012d3
SSDEEP 49152:zereFL30O/xFBOFFW34tx9sZ7/3UY0nb5D:zueFF/xrMO4P9s10t
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000\Control Panel\International\Geo\Nation	BC32.bin.exe

Loads dropped DLL 3 IoCs

pid	Process
1944	rundll32.exe
1924	rundll32.exe
1924	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-618519468-4027732583-1827558364-1000_Classes\Local Settings	BC32.bin.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4748	4140	BC32.bin.exe	86
PID 4140 wrote to memory of 4748	4140	BC32.bin.exe	86
PID 4140 wrote to memory of 4748	4140	BC32.bin.exe	86
PID 4748 wrote to memory of 1944	4748	control.exe	88
PID 4748 wrote to memory of 1944	4748	control.exe	88
PID 4748 wrote to memory of 1944	4748	control.exe	88
PID 1944 wrote to memory of 3392	1944	rundll32.exe	93
PID 1944 wrote to memory of 3392	1944	rundll32.exe	93
PID 3392 wrote to memory of 1924	3392	RunDll32.exe	94
PID 3392 wrote to memory of 1924	3392	RunDll32.exe	94
PID 3392 wrote to memory of 1924	3392	RunDll32.exe	94

C:\Users\Admin\AppData\Local\Temp\BC32.bin.exe
"C:\Users\Admin\AppData\Local\Temp\BC32.bin.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\control.exe
  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Windows\SysWOW64\rundll32.exe
    "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1944
  - - C:\Windows\system32\RunDll32.exe
      C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl",
        5⤵
        Loads dropped DLL
        
        PID:1924

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LJtDWS~O.cpl

Path C:\Users\Admin\AppData\Local\Temp\LJtDWS~O.cpl
Size 1.3MB
SHA256 fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
MD5 c18be9990d123202d3a6f04d2565c9fc
SHA1 15ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA512 6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
SSDEEP 24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
MD5 c18be9990d123202d3a6f04d2565c9fc
SHA1 15ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA512 6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
SSDEEP 24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
MD5 c18be9990d123202d3a6f04d2565c9fc
SHA1 15ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA512 6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
SSDEEP 24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
MD5 c18be9990d123202d3a6f04d2565c9fc
SHA1 15ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA512 6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
SSDEEP 24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LjtdWS~o.cpl

Path C:\Users\Admin\AppData\Local\Temp\LjtdWS~o.cpl
Size 1.3MB
SHA256 fe587e83e84faaaf71bce643c77b077a3c8162bb63973cc43831a0f9f4c7dbe9
MD5 c18be9990d123202d3a6f04d2565c9fc
SHA1 15ffd3ff9f0d3b96e78d87cd2a8141f060c67902
SHA512 6000ad5d38b3ee99fd4391c01949ebc5a2b6243ad0c7062fc157926cece51abbff56526d5c8c350de5a492e60035b46b8b50b7217a348a1b5160caa82cc54296
SSDEEP 24576:+gpSttGlLfpm/myRvpDRs0EY/J7NJtP7lK+/aeksSr9:Z5LyR177pKYaevc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1924-157-0x00000000009D0000-0x00000000009D6000-memory.dmp

Download

memory/1924-164-0x0000000002CE0000-0x0000000002DDE000-memory.dmp

Download

memory/1924-163-0x0000000002CE0000-0x0000000002DDE000-memory.dmp

Download

memory/1924-160-0x0000000002CE0000-0x0000000002DDE000-memory.dmp

Download

memory/1924-159-0x0000000002BC0000-0x0000000002CD9000-memory.dmp

Download

memory/1924-155-0x0000000002730000-0x000000000287D000-memory.dmp

Download

memory/1924-156-0x0000000002730000-0x000000000287D000-memory.dmp

Download

memory/1944-145-0x0000000000400000-0x000000000054D000-memory.dmp

Download

memory/1944-152-0x0000000003130000-0x000000000322E000-memory.dmp

Download

memory/1944-151-0x0000000003130000-0x000000000322E000-memory.dmp

Download

memory/1944-148-0x0000000003130000-0x000000000322E000-memory.dmp

Download

memory/1944-147-0x0000000003010000-0x0000000003129000-memory.dmp

Download

memory/1944-144-0x0000000002C90000-0x0000000002C96000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads