bitpaymer | 801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b

Analysis

Target
801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe
Size 3.5MB
Sample220428-mslr9abff9
SHA256 801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b
MD5 9141d1d189afc2e300121e71a211c925
SHA1 ee5ac27425616878a932516000c04dedbde5b715
SHA512 88ace82b8f8b7a8160113962d78f823e56d7c96494c830c53760d9f906b9a922f7d6bd8204ab91df3c7ac260fd8dc1c7cd41bb1aa3dd6936107456ed283c9048
MD5 SHA1 SHA512

Score

10^/10

BitPaymer
Bitpaymer is a Trojan horse that encrypts files on a computer.
ransomware backdoor bitpaymer

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1288	1092	WerFault.exe	26

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1092 wrote to memory of 1288	1092	801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe	28
PID 1092 wrote to memory of 1288	1092	801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe	28
PID 1092 wrote to memory of 1288	1092	801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe	28
PID 1092 wrote to memory of 1288	1092	801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe	28

C:\Users\Admin\AppData\Local\Temp\801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe
"C:\Users\Admin\AppData\Local\Temp\801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 36
  2⤵
  - Program crash
  PID:1288

memory/1092-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Download

memory/1092-55-0x0000000000670000-0x00000000009E7000-memory.dmp

Download

memory/1092-59-0x00000000000D0000-0x00000000000D6000-memory.dmp

Download