43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 01:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe
Size

197KB
MD5

1f713539b5dbfdf2ef5b0620806af6ee
SHA1

a1b82c2f270bef7afd1fc2e5d102832695d06be1
SHA256

43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb
SHA512

ede9a0fa39da67d7116da9e207807b5bc893a975621e39bb600fc4dac8025ce4ac2faccaf0b98723a3f09050db55dc2498a89ecb203dbd24e5b4bc6f9139bb87
SSDEEP

6144:rBs27MMLyX5HXXXDTXXXOGqIII+pXXX5AYjKXXXDoXXXG6XXXxXXXLIIIEAkOCOJ:rK20HXXX/XXXFqIIIcXXX5j2XXXcXXX4

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe

Executes dropped EXE 1 IoCs

pid	Process
2648	bqchost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Debug\bqchost.exe	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe
File opened for modification	C:\Windows\Debug\bqchost.exe	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2840	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4648	2840	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe	92
PID 2840 wrote to memory of 4648	2840	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe	92
PID 2840 wrote to memory of 4648	2840	43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe	92

C:\Users\Admin\AppData\Local\Temp\43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe
"C:\Users\Admin\AppData\Local\Temp\43c794f124ae4ec6e85cd828af00470301c0bbed2e76fc63b95177a7010f0abb.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\43C794~1.EXE > nul
  2⤵
  PID:4648

C:\Windows\Debug\bqchost.exe
C:\Windows\Debug\bqchost.exe
1⤵
- Executes dropped EXE
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\bqchost.exe

Filesize
197KB

MD5
df51d28fa07d9574d3b04de772effbf1

SHA1
41bf8b9ec482a5d730945b557b1d83480b4df3bb

SHA256
de4657b0958d80a6c3903312186ff0c16e5c6dfdaa9bd7bbd7b5d4ec6ac5c041

SHA512
585dfe12e9e0bbc42c9b2db4a0d926812998491945b000f7b1fd070a52d56e3647572901f44fbcbcf593a5a8d392b3f218fa457403edcd8818e961077e9702dc

Download Submit