4793380fe37d83f037465b6af4f0d3505679aab76ebe919e49e7eb2a43ec4f2c

General

Target

2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
Size

11.8MB
MD5

f826928418350daed0959b6fe5837208
SHA1

5a56cdc748dfb2ba91859f47e7e105ac36fe4654
SHA256

4793380fe37d83f037465b6af4f0d3505679aab76ebe919e49e7eb2a43ec4f2c
SHA512

b7df8ceb0a66bcace5c5d912c19528c25a9742d956b7744fd733adeccb1d48fa22d7d5f60030356384e435cdb8cdd75e1523afd54707792107a728a1ac0b8f88
SSDEEP

196608:h+cpkunept7RjSs9B3XpknY7RU1v5mifvMx3hhF3h8TtHeEGCnhGMwL/drW:h+cpzneprzjZr8pfwdaBevMwL/JW

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

Processes:

QwtoUzWytMxpn9D.exeCTS.exe

pid process

4036 QwtoUzWytMxpn9D.exe
1680 CTS.exe
Loads dropped DLL 5 IoCs

Processes:

QwtoUzWytMxpn9D.exe

pid process

4036 QwtoUzWytMxpn9D.exe
4036 QwtoUzWytMxpn9D.exe
4036 QwtoUzWytMxpn9D.exe
4036 QwtoUzWytMxpn9D.exe
4036 QwtoUzWytMxpn9D.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4036	QwtoUzWytMxpn9D.exe
1680	CTS.exe

pid	process
4036	QwtoUzWytMxpn9D.exe
4036	QwtoUzWytMxpn9D.exe
4036	QwtoUzWytMxpn9D.exe
4036	QwtoUzWytMxpn9D.exe
4036	QwtoUzWytMxpn9D.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exeCTS.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe"	CTS.exe

Drops file in Windows directory 2 IoCs

Processes:

2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exeCTS.exe

description ioc process

File created C:\Windows\CTS.exe 2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
File created C:\Windows\CTS.exe CTS.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\CTS.exe	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
File created	C:\Windows\CTS.exe	CTS.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\QwtoUzWytMxpn9D.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\QwtoUzWytMxpn9D.exe	nsis_installer_2

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exeCTS.exe

description pid process

Token: SeDebugPrivilege 3728 2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
Token: SeDebugPrivilege 1680 CTS.exe

description	pid	process
Token: SeDebugPrivilege	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
Token: SeDebugPrivilege	1680	CTS.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe

description	pid	process	target process
PID 3728 wrote to memory of 4036	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	QwtoUzWytMxpn9D.exe
PID 3728 wrote to memory of 4036	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	QwtoUzWytMxpn9D.exe
PID 3728 wrote to memory of 4036	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	QwtoUzWytMxpn9D.exe
PID 3728 wrote to memory of 1680	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	CTS.exe
PID 3728 wrote to memory of 1680	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	CTS.exe
PID 3728 wrote to memory of 1680	3728	2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe	CTS.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-28_f826928418350daed0959b6fe5837208_bkransomware.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3728

C:\Users\Admin\AppData\Local\Temp\QwtoUzWytMxpn9D.exe
C:\Users\Admin\AppData\Local\Temp\QwtoUzWytMxpn9D.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4036

C:\Windows\CTS.exe
"C:\Windows\CTS.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1680

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml
Filesize
392KB

MD5
7692fa9faab1bb1b2920ebca2bb33458

SHA1
422e1f9fc950b659bb5fd3c2e00614393b0fb953

SHA256
b0bb2c3e1d61f1695e29f644df0aeae1251196748af7295f45c6933a43b62d35

SHA512
4fa4fa6453883e9f8659f43c5d62e19fd08aad7964c6a7578d526ca6940471104473a721fcadebb1c81309c983dac8cd806ed80ad1dd5f8781f6414fb3e02d13

Download Submit
C:\Users\Admin\AppData\Local\Temp\QwtoUzWytMxpn9D.exe
Filesize
11.7MB

MD5
d50d5712566f1df16b5aea21b9e0ee24

SHA1
f442aa68ec8d838625f382bcf273f5d0f66427ea

SHA256
e102238100a8b97d22559065e3b19379757aeda932c36916d2c84a4178921854

SHA512
f9b8d6762a8b00392519b949083d5f0a3670ed24583ed4aaa7570cbc24914e0c19933486004d8949fbee930b8f0e66b50a05e3c478c193ba269677dcd619d7d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj372F.tmp\InstallOptions.dll
Filesize
14KB

MD5
d753362649aecd60ff434adf171a4e7f

SHA1
3b752ad064e06e21822c8958ae22e9a6bb8cf3d0

SHA256
8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586

SHA512
41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj372F.tmp\System.dll
Filesize
10KB

MD5
56a321bd011112ec5d8a32b2f6fd3231

SHA1
df20e3a35a1636de64df5290ae5e4e7572447f78

SHA256
bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1

SHA512
5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj372F.tmp\UserInfo.dll
Filesize
4KB

MD5
e840e7f30c85e22b09a41098ff3f3343

SHA1
ad1eb7b2ba66ae87641947025736c67efbc4b9d8

SHA256
6707e9e88dec460c2cf421bd2bc6a314f15717527cb60dcad2fbb7352ae711a3

SHA512
ea1362c9e7ac9666d6cbfc02939a6e9c411f6aef113dc8ec898c383fc4ecf9d957c6ad8f75c33847d5da0b4427c861f0ccaf240cb1def189313de2948881dc1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsj372F.tmp\ioSpecial.ini
Filesize
700B

MD5
11603a8035f8c27d2212c2b623c70f0c

SHA1
5759df636686ae4670b50d01d77d66364780f467

SHA256
e80e720d635f629e05bb045a73ca709e095ace977565ac3885f2e88bc99b4532

SHA512
e5102ee988fda9788fec9b2a6fcad122b1d80347e98f3b13886229d502e6280aa9cd035ac3a7a2ebdb5c551e64fbc77dedca59cc7f1777a61c4a9bd06dde440d

Download Submit
C:\Windows\CTS.exe
Filesize
71KB

MD5
f9d4ab0a726adc9b5e4b7d7b724912f1

SHA1
3d42ca2098475924f70ee4a831c4f003b4682328

SHA256
b43be87e8586ca5e995979883468f3b3d9dc5212fbfd0b5f3341a5b7c56e0fbc

SHA512
22a5f0e4b2716244e978ee50771823926f86baf0382ece48fd049f039cf77b5eb0691d83c61148903cff081fdbea969f47b8ed521647717f42bbed5c64552432

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads