bitpaymer | 801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b | Triage™

Analysis

max time kernel
140s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
28/04/2022, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe
Size 3.5MB
Sample220428-mslr9abff9
SHA256 801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b
MD5 9141d1d189afc2e300121e71a211c925
SHA1 ee5ac27425616878a932516000c04dedbde5b715
SHA512 88ace82b8f8b7a8160113962d78f823e56d7c96494c830c53760d9f906b9a922f7d6bd8204ab91df3c7ac260fd8dc1c7cd41bb1aa3dd6936107456ed283c9048
MD5 SHA1 SHA512

Score

10^/10

bitpaymer backdoor ransomware

Malware Config

Signatures

BitPaymer
Bitpaymer is a Trojan horse that encrypts files on a computer.
ransomware backdoor bitpaymer

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1264	3588	WerFault.exe	80
4428	3144	WerFault.exe	94

C:\Users\Admin\AppData\Local\Temp\801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe
"C:\Users\Admin\AppData\Local\Temp\801b04a1504f167c25f568f8d7cbac13bdde6440a609d0dcd64ebe225c197f9b.exe"
1⤵
PID:3588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 148
  2⤵
  - Program crash
  PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588
1⤵
PID:1156

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 520 -p 3144 -ip 3144
1⤵
PID:4892

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3144 -s 772
1⤵
- Program crash
PID:4428

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3588-130-0x00000000009B0000-0x0000000000D27000-memory.dmp

Download

memory/3588-133-0x00000000009A0000-0x00000000009A6000-memory.dmp

Download