bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55

General

Target

bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Size

94KB
MD5

c78aded8944115be330e3360e575114c
SHA1

1907360c6921cf91a76762fdc23643e42fc5ac97
SHA256

bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55
SHA512

531d14d207da2a57da4ccb5efaf4b633749135bebdece54c60be2e6ff293b75f7a43d566da72b9e3063d67945a1dbe4cee5d019180fd4b1b601c06f8f7ba3bfc
SSDEEP

1536:KNHZBkgy+pyDBmntHc1ooEofGWHplURQDLRfRa9HprmRfRZ:KN5BkgjYDBmntHcCoEo+CgeDL5wkpv

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Dknpmdfc.exe

Executes dropped EXE 3 IoCs

pid	Process
4656	Dddhpjof.exe
752	Dknpmdfc.exe
4832	Dmllipeg.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Dddhpjof.exe	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
File created	C:\Windows\SysWOW64\Nokpao32.dll	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Kngpec32.dll	Dknpmdfc.exe
File created	C:\Windows\SysWOW64\Dddhpjof.exe	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
File created	C:\Windows\SysWOW64\Amjknl32.dll	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
File created	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File opened for modification	C:\Windows\SysWOW64\Dknpmdfc.exe	Dddhpjof.exe
File created	C:\Windows\SysWOW64\Dmllipeg.exe	Dknpmdfc.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3880	4832	WerFault.exe	85

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dddhpjof.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dknpmdfc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dmllipeg.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nokpao32.dll"	Dddhpjof.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Kngpec32.dll"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dddhpjof.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dknpmdfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Dknpmdfc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Amjknl32.dll"	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Dddhpjof.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 4656	3328	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe	83
PID 3328 wrote to memory of 4656	3328	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe	83
PID 3328 wrote to memory of 4656	3328	bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe	83
PID 4656 wrote to memory of 752	4656	Dddhpjof.exe	84
PID 4656 wrote to memory of 752	4656	Dddhpjof.exe	84
PID 4656 wrote to memory of 752	4656	Dddhpjof.exe	84
PID 752 wrote to memory of 4832	752	Dknpmdfc.exe	85
PID 752 wrote to memory of 4832	752	Dknpmdfc.exe	85
PID 752 wrote to memory of 4832	752	Dknpmdfc.exe	85

C:\Users\Admin\AppData\Local\Temp\bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe
"C:\Users\Admin\AppData\Local\Temp\bc1c0bf29786dc75d6b4840c0301ab516144f4996faef080e9f3e3d583425a55.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\Dddhpjof.exe
  C:\Windows\system32\Dddhpjof.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\Dknpmdfc.exe
    C:\Windows\system32\Dknpmdfc.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:752
  - - C:\Windows\SysWOW64\Dmllipeg.exe
      C:\Windows\system32\Dmllipeg.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4832
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 416
        5⤵
        Program crash
        
        PID:3880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4832 -ip 4832
1⤵
PID:4428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Dddhpjof.exe

Filesize
94KB

MD5
5eed2c83e7bc67abccb6b75f4ec51529

SHA1
86d72080c13a9e162f00748faed67e94ec1c46ab

SHA256
8c3157449e60574edf11cc72d4637b253fefb451b440fa8e191b8ee12506a5b9

SHA512
3ae9e1059aefdea46ccd707e4a9c07a24ec56f0679acc062e5fe4b692f382d438e1e90497e126a2a32ac468582e31e0dceecfa5ab06d43a11ac11fd31e74cbe3

Download Submit
C:\Windows\SysWOW64\Dknpmdfc.exe

Filesize
94KB

MD5
1d0c53d8babbb3f132928f3d9d41357e

SHA1
e54ea83755d0659d94d839017bd916119b0e5963

SHA256
7f43cde001c06fe35674ef899a4bfa2dc75b2a5b5bade622d83ef55c2fa4c0cd

SHA512
5b5ffa8bb62c2d23bc3be04c23c211e3da0637a90d7bbba33c9f67f96227ce3e89a721d7fa97be999f88760d4f4ebdcc9c4e747918ef2b09ca9294df155f9036

Download Submit
C:\Windows\SysWOW64\Dmllipeg.exe

Filesize
94KB

MD5
117bba748103438ccaa28ab0e1d292f1

SHA1
d2e2ede024cc3bd93e9185a25c194f7baa1d8ada

SHA256
99c84b0b29ab068b29e1806b6d1c7b5bce57bba3cb0c1fa72cae705d56d1640e

SHA512
846975d5e0bf5dc7127bceeda63e72f3fa634cc5acec70197b4e43b745fb4d366e88c6d5918e438851927f37a5a690313107f46ec3847013087083dfaf75b5f4

Download Submit
memory/752-16-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/752-26-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3328-0-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3328-28-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4656-7-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4656-27-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4832-23-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/4832-25-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads