5b084762eda98304bfce1ad32426c4f08a41ad56790547d206b48461c008c118

General

Target

389be271777119b0ff7efe2a3714f130N.exe
Size

23KB
MD5

389be271777119b0ff7efe2a3714f130
SHA1

1641c0c917d6c498775ff9577fb41bdf0cf7c6b2
SHA256

5b084762eda98304bfce1ad32426c4f08a41ad56790547d206b48461c008c118
SHA512

aa394196c3dbb1fd38dc43267ae3a1eda8c9ce5f946beebbb29808ee6c2589d70919af5a3a430c52aca0fe60356c5179c92dbbb5043bb038a1eb376797029e1b
SSDEEP

384:+J5+c5mibCpKAjndr3Vo4G/usaNJawcudoD7UXlOIJquYT:uAcYimoqdm9gnbcuyD7U19m

Score

8^/10

defense_evasion discovery evasion upx

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
5004	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation	389be271777119b0ff7efe2a3714f130N.exe

Executes dropped EXE 1 IoCs

pid	Process
2404	bqchost.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/800-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/files/0x000900000002347c-3.dat	upx
behavioral2/memory/800-6-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2404-7-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2404-10-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2404-13-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral2/memory/2404-16-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\bqchost.exe	389be271777119b0ff7efe2a3714f130N.exe
File opened for modification	C:\Windows\Debug\bqchost.exe	attrib.exe
File created	C:\Windows\Debug\bqchost.exe	389be271777119b0ff7efe2a3714f130N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bqchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	389be271777119b0ff7efe2a3714f130N.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	800	389be271777119b0ff7efe2a3714f130N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 5004	800	389be271777119b0ff7efe2a3714f130N.exe	83
PID 800 wrote to memory of 5004	800	389be271777119b0ff7efe2a3714f130N.exe	83
PID 800 wrote to memory of 5004	800	389be271777119b0ff7efe2a3714f130N.exe	83
PID 800 wrote to memory of 2116	800	389be271777119b0ff7efe2a3714f130N.exe	89
PID 800 wrote to memory of 2116	800	389be271777119b0ff7efe2a3714f130N.exe	89
PID 800 wrote to memory of 2116	800	389be271777119b0ff7efe2a3714f130N.exe	89

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5004	attrib.exe

C:\Users\Admin\AppData\Local\Temp\389be271777119b0ff7efe2a3714f130N.exe
"C:\Users\Admin\AppData\Local\Temp\389be271777119b0ff7efe2a3714f130N.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:800
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\bqchost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5004
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\389BE2~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2116

C:\Windows\Debug\bqchost.exe
C:\Windows\Debug\bqchost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

2

T1564

Hidden Files and Directories

2

T1564.001

Indicator Removal

1

T1070

File Deletion

1

T1070.004

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\bqchost.exe

Filesize
23KB

MD5
a3bb532c1f52ea3d1bf061597621329f

SHA1
27a7dbffca6489a9111d8e29a47fa67ac5420528

SHA256
0246594ad73a1fd850cf5479c7aa3447d64ae98dd5cd0b8ede4c24b3aabf7255

SHA512
0e6389ca1d5d9f8ce24f0f1802731948d340eb23f35ad9d9edba98e411bc58731050fd630eb57136e7001b82942638ddf71dbb4c19817f93d775a3dd4678bdf7

Download Submit
memory/800-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/800-6-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2404-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2404-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2404-13-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2404-16-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads