b162ee6b1a26633ef8eb61125f1de5556983fc17dc196655458815a16d4e805d

General

Target

7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
Size

37KB
MD5

7a57a6d9bac6be7f0462fd4b9c7e5e31
SHA1

b4b7ec5fa19aed61342244c1b598ad09a8254076
SHA256

b162ee6b1a26633ef8eb61125f1de5556983fc17dc196655458815a16d4e805d
SHA512

09472ffbe78f3ea9d29540f1983fa02031b48829bbcc057d5ba9e8dc7a2e818740d7d9ccd2df44e1623a133952ea4322b70b9bb024f160ee14ee354112bfb675
SSDEEP

768:jpuxbbb93pfzxWt7QYQ8IgDidhHPjAJYvHF0lwY437avXKrnrj:j0Rbb5WRQYt9ir/2wraI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2816	BCSSync.exe
2716	BCSSync.exe

Loads dropped DLL 2 IoCs

pid	Process
2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe

Unexpected DNS network traffic destination 10 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251
Destination IP	50.7.247.251

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 852 set thread context of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 2816 set thread context of 2716	2816	BCSSync.exe	30

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Fonts\6qsY4xHB3.com	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
2716	BCSSync.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 852 wrote to memory of 2384	852	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	28
PID 2384 wrote to memory of 2816	2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	29
PID 2384 wrote to memory of 2816	2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	29
PID 2384 wrote to memory of 2816	2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	29
PID 2384 wrote to memory of 2816	2384	7a57a6d9bac6be7f0462fd4b9c7e5e31.exe	29
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2816 wrote to memory of 2716	2816	BCSSync.exe	30
PID 2716 wrote to memory of 2332	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2332	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2332	2716	BCSSync.exe	31
PID 2716 wrote to memory of 2332	2716	BCSSync.exe	31

C:\Users\Admin\AppData\Local\Temp\7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
"C:\Users\Admin\AppData\Local\Temp\7a57a6d9bac6be7f0462fd4b9c7e5e31.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852
- C:\Users\Admin\AppData\Local\Temp\7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
  C:\Users\Admin\AppData\Local\Temp\7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
  2⤵
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
    "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" DEL:C:\Users\Admin\AppData\Local\Temp\7a57a6d9bac6be7f0462fd4b9c7e5e31.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
      "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync .exe" "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe"
        5⤵
        
        PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe

Filesize
37KB

MD5
8cd4023300b4149e041beaa44d4cb1f6

SHA1
5db0d0258fe205668f6686d915e7410aad83da63

SHA256
8366c8ebf7eb58dbe31c8686947ec32c901e5f20480440230fa0f065354f2e26

SHA512
dc770a79c91739eaa8afc7b9fb9ef0625c5b67f9aeff25aa384ae9f2bf793b5b21bf652466e165bd9c1d4590afc0d440653646978cd572b69d72334e09fd0ecd

Download Submit
memory/852-13-0x00000000005A0000-0x00000000006A0000-memory.dmp

Filesize
1024KB

Download
memory/2384-16-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-22-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-18-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-24-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-20-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-26-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-14-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-51-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2384-69-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2716-72-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/2816-52-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download
memory/2816-58-0x00000000005E0000-0x00000000006E0000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing