c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c

Analysis

max time kernel
143s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11-10-2023 07:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
Size

199KB
MD5

92dbbb8753a4faec9db1f8aab7abaf3a
SHA1

3d3502c6c9b3a8c597337b6adfe596be0ca87b32
SHA256

c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c
SHA512

eaf5113de9de235cbf0b9c98422cf16de90fea4b7c608ac0d1670b4142ca0eb8f26794917643623f9ff56e09bbfa867619e2399cd81c73d35e149ccee29de696
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOM:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXXt

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1141987721-3945596982-3297311814-1000\Control Panel\International\Geo\Nation	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe

Executes dropped EXE 1 IoCs

pid	Process
1744	bqchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\bqchost.exe	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
File opened for modification	C:\Windows\Debug\bqchost.exe	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	bqchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bqchost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2116	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2148	2116	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	85
PID 2116 wrote to memory of 2148	2116	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	85
PID 2116 wrote to memory of 2148	2116	c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe	85

C:\Users\Admin\AppData\Local\Temp\c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe
"C:\Users\Admin\AppData\Local\Temp\c325be488291c43d7402f426540469a28512ff564f44f5a9a3d1c80864de2e2c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C325BE~1.EXE > nul
  2⤵
  PID:2148

C:\Windows\Debug\bqchost.exe
C:\Windows\Debug\bqchost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:1744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\bqchost.exe

Filesize
199KB

MD5
c3fd541c87caad4a27e1630a5eae0ae7

SHA1
9d557c8ab5a39799b80e7a8ebbb97190fb59b6aa

SHA256
b4dba8a1d6d0d45881dff3bcab82617ab36cc60b423e902071577f83d6b8e6bb

SHA512
8ec06d8b1f00afff871204736fb0d7ed97051232e6253c2a820c4f2c4afa9233e8ae37a3927caca6b16339a51984c5ddeced23504f9dfed64ba847d0c017b05c

Download Submit
C:\Windows\debug\bqchost.exe

Filesize
199KB

MD5
c3fd541c87caad4a27e1630a5eae0ae7

SHA1
9d557c8ab5a39799b80e7a8ebbb97190fb59b6aa

SHA256
b4dba8a1d6d0d45881dff3bcab82617ab36cc60b423e902071577f83d6b8e6bb

SHA512
8ec06d8b1f00afff871204736fb0d7ed97051232e6253c2a820c4f2c4afa9233e8ae37a3927caca6b16339a51984c5ddeced23504f9dfed64ba847d0c017b05c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads