3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b

General

Target

3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Size

376KB
MD5

7d1f1d7de3aa307b4fb9de6cafaf7842
SHA1

7f97513ed07e5802a919a3a67dfb1868d34fec9c
SHA256

3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b
SHA512

56cec8460e90f4a48f0e37ba2339e0307e649594e2598ac8a530ff7c3e71a8dcb69aedba841f72d8330f06e2b2c568d25353c27a60a0303cec1703d83c6c9fb4
SSDEEP

6144:SSy9P3C7oQ0IV/Atl/AtW1OE43V1+25CzRoQ0Ibl4HdE43V1+2:oa50I2mi4lCzb0IF4

Score

10^/10

discovery persistence

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bdkgocpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bdkgocpm.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bejdiffp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bejdiffp.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Bjbcfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79FEACFF-FFCE-815E-A900-316290B5B738}"	Bjbcfn32.exe

Executes dropped EXE 4 IoCs

pid	Process
2736	Bjbcfn32.exe
2876	Bdkgocpm.exe
2308	Bejdiffp.exe
2660	Cacacg32.exe

Loads dropped DLL 12 IoCs

pid	Process
2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
2736	Bjbcfn32.exe
2736	Bjbcfn32.exe
2876	Bdkgocpm.exe
2876	Bdkgocpm.exe
2308	Bejdiffp.exe
2308	Bejdiffp.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Bdkgocpm.exe	Bjbcfn32.exe
File created	C:\Windows\SysWOW64\Fcohbnpe.dll	Bjbcfn32.exe
File created	C:\Windows\SysWOW64\Bejdiffp.exe	Bdkgocpm.exe
File created	C:\Windows\SysWOW64\Nmmfff32.dll	Bdkgocpm.exe
File opened for modification	C:\Windows\SysWOW64\Cacacg32.exe	Bejdiffp.exe
File created	C:\Windows\SysWOW64\Fdlpjk32.dll	Bejdiffp.exe
File created	C:\Windows\SysWOW64\Bjbcfn32.exe	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
File created	C:\Windows\SysWOW64\Hqlhpf32.dll	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
File created	C:\Windows\SysWOW64\Bdkgocpm.exe	Bjbcfn32.exe
File opened for modification	C:\Windows\SysWOW64\Bejdiffp.exe	Bdkgocpm.exe
File created	C:\Windows\SysWOW64\Cacacg32.exe	Bejdiffp.exe
File opened for modification	C:\Windows\SysWOW64\Bjbcfn32.exe	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	2660	WerFault.exe	33

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bjbcfn32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bdkgocpm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Bejdiffp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cacacg32.exe

Modifies registry class 15 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bjbcfn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bjbcfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bdkgocpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Nmmfff32.dll"	Bdkgocpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bdkgocpm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	Bejdiffp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fcohbnpe.dll"	Bjbcfn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32	Bejdiffp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hqlhpf32.dll"	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ThreadingModel = "Apartment"	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{79FEACFF-FFCE-815E-A900-316290B5B738}\InProcServer32\ = "C:\\Windows\\SysWow64\\Fdlpjk32.dll"	Bejdiffp.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 2736	2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe	30
PID 2844 wrote to memory of 2736	2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe	30
PID 2844 wrote to memory of 2736	2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe	30
PID 2844 wrote to memory of 2736	2844	3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe	30
PID 2736 wrote to memory of 2876	2736	Bjbcfn32.exe	31
PID 2736 wrote to memory of 2876	2736	Bjbcfn32.exe	31
PID 2736 wrote to memory of 2876	2736	Bjbcfn32.exe	31
PID 2736 wrote to memory of 2876	2736	Bjbcfn32.exe	31
PID 2876 wrote to memory of 2308	2876	Bdkgocpm.exe	32
PID 2876 wrote to memory of 2308	2876	Bdkgocpm.exe	32
PID 2876 wrote to memory of 2308	2876	Bdkgocpm.exe	32
PID 2876 wrote to memory of 2308	2876	Bdkgocpm.exe	32
PID 2308 wrote to memory of 2660	2308	Bejdiffp.exe	33
PID 2308 wrote to memory of 2660	2308	Bejdiffp.exe	33
PID 2308 wrote to memory of 2660	2308	Bejdiffp.exe	33
PID 2308 wrote to memory of 2660	2308	Bejdiffp.exe	33
PID 2660 wrote to memory of 2116	2660	Cacacg32.exe	34
PID 2660 wrote to memory of 2116	2660	Cacacg32.exe	34
PID 2660 wrote to memory of 2116	2660	Cacacg32.exe	34
PID 2660 wrote to memory of 2116	2660	Cacacg32.exe	34

C:\Users\Admin\AppData\Local\Temp\3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe
"C:\Users\Admin\AppData\Local\Temp\3f9dd394d52a2bb5e621e807ea3a7d562da2c9486a57b1ac5c2e10250748e02b.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Windows\SysWOW64\Bjbcfn32.exe
  C:\Windows\system32\Bjbcfn32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\Bdkgocpm.exe
    C:\Windows\system32\Bdkgocpm.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2876
  - - C:\Windows\SysWOW64\Bejdiffp.exe
      C:\Windows\system32\Bejdiffp.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2308
    - - C:\Windows\SysWOW64\Cacacg32.exe
        
        C:\Windows\system32\Cacacg32.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2660
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2660 -s 140
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:2116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\Bejdiffp.exe

Filesize
376KB

MD5
95f7503e2b4d291680b850ac31409b8c

SHA1
5e5db0edecb38d7c4b57b0710b197c41b6eaf619

SHA256
face857d5384a7ef2697478b720c992c15f65dfd66c82dd74381bed8afec96af

SHA512
7b3a13e8fb6bf952d2ba0698e027282bea9fe69bcd734e3896c414db325dfa98e7f48b1517018d0e63cff734bd562e3047bfd2dc3bf05c4112ce7d13a003effb

Download Submit
C:\Windows\SysWOW64\Bjbcfn32.exe

Filesize
376KB

MD5
cde68797eac3cd237e93b0d850b9bcd9

SHA1
ac5ef5554895b9b7fc52e984a37bd4111ed3bc89

SHA256
36c603265ef7f7ec07596a26875a8fa2c9ee8fe82032903c928ece4433f7e580

SHA512
6274788ec9d2efe77886c2bab8073bb7b75225ef41a6772b30266c367fed946b528ae0ce9c6490c31ef07d24bef78e84b5c4558e23fbd2200c7e4dd98880c56f

Download Submit
\Windows\SysWOW64\Bdkgocpm.exe

Filesize
376KB

MD5
ebdf6d5ffcd02d1371844b8f2b273beb

SHA1
feb159d30816a7cc8996cea26aa141d655684eae

SHA256
07420439bcf0b7e26e08d6122380898b707697f5cfbb2a5d032b370f2d1caff4

SHA512
308ca232121147f0a0fc36d58d103c1de10732badff95f0d27312516b826d4e796ae777e72063e68c8b89be5691d6fe6074c1122a3a805511b5ba0b07c5ee914

Download Submit
\Windows\SysWOW64\Cacacg32.exe

Filesize
376KB

MD5
50f1eba2bcb9ff6ef6ba7c4297ab594b

SHA1
aebd7cf1f087ea63d8908e43d43be80e7ea330a9

SHA256
617d43fa404737d88e817509afee883a34c4d2102d51c71108a5f348af7503f0

SHA512
83c6719ee75d584ea68fa70d8b812d9d78248165be1fe8045548f672e4119ed964ecc4bca8cb9e54ebd98abc778a083821e4729f0ad49e3d15c9f23c39cc525a

Download Submit
memory/2308-66-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2308-41-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2660-54-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2660-68-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2736-64-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2736-25-0x00000000002D0000-0x000000000032E000-memory.dmp

Filesize
376KB

Download
memory/2736-13-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2844-0-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2844-11-0x00000000002F0000-0x000000000034E000-memory.dmp

Filesize
376KB

Download
memory/2844-67-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2876-32-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2876-63-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/2876-40-0x0000000001F50000-0x0000000001FAE000-memory.dmp

Filesize
376KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads