d47317356bb7d44069e7c38cbb8deb3e1bc472ec90fe270b0ef85f1a6bde67b5

General

Target

004c577988aa60a83cf44bc796dea53e.exe
Size

34KB
MD5

004c577988aa60a83cf44bc796dea53e
SHA1

c66d80416dbe145f138cd54a9e2d167bd44e06ca
SHA256

d47317356bb7d44069e7c38cbb8deb3e1bc472ec90fe270b0ef85f1a6bde67b5
SHA512

da23a3ca1d01e278b168353114339e3d46fca8d6ae5a28d566450b04f4fc8ec3f5c68d3a53f385417475f3275107a0fc264f4e5da57a1bbe49818a81481183bb
SSDEEP

768:TdaYVyu0KnshGZxpv/ncZfgp/6PVo1I/C1setyWvyenC2leD1U:5aeyfheJnG496Pzq1VQWmDU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2568	BCSSync.exe
2544	BCSSync.exe

Loads dropped DLL 3 IoCs

pid	Process
2764	004c577988aa60a83cf44bc796dea53e.exe
2764	004c577988aa60a83cf44bc796dea53e.exe
2568	BCSSync.exe

Unexpected DNS network traffic destination 5 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139
Destination IP	83.133.119.139

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2800 set thread context of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2568 set thread context of 2544	2568	BCSSync.exe	31

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	004c577988aa60a83cf44bc796dea53e.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	004c577988aa60a83cf44bc796dea53e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\06qq7.com	004c577988aa60a83cf44bc796dea53e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2544	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2800 wrote to memory of 2764	2800	004c577988aa60a83cf44bc796dea53e.exe	29
PID 2764 wrote to memory of 2568	2764	004c577988aa60a83cf44bc796dea53e.exe	30
PID 2764 wrote to memory of 2568	2764	004c577988aa60a83cf44bc796dea53e.exe	30
PID 2764 wrote to memory of 2568	2764	004c577988aa60a83cf44bc796dea53e.exe	30
PID 2764 wrote to memory of 2568	2764	004c577988aa60a83cf44bc796dea53e.exe	30
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2568 wrote to memory of 2544	2568	BCSSync.exe	31
PID 2544 wrote to memory of 3004	2544	BCSSync.exe	32
PID 2544 wrote to memory of 3004	2544	BCSSync.exe	32
PID 2544 wrote to memory of 3004	2544	BCSSync.exe	32
PID 2544 wrote to memory of 3004	2544	BCSSync.exe	32

C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe
"C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe
  "C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe"
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\004c577988aa60a83cf44bc796dea53e.exe
        5⤵
        
        PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
34KB

MD5
3d47b5ddba696d4d0e12c9963aca4b8f

SHA1
2538173663ffca43d2c259a78a030336d0f97a78

SHA256
60ac60f3b5175149f9412fad076d22ba923dc876e1c3626a0c0811196fda79e9

SHA512
6e78aa6dddc9b4a3ad605175606a8f768af2924b81637e997fc3da0040a6df7de97cd0e06ad7dc5cee3bdf9f04487db5d55c640ae3a94ab5891a2526033dff68

Download Submit
memory/2544-48-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-0-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-2-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-4-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-6-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-8-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-10-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-12-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-13-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2764-14-0x0000000010000000-0x000000001000A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing