bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0

Analysis

max time kernel
192s
max time network
208s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
06/12/2022, 11:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe
Size

124KB
MD5

fd68f0744f7a12cd38124377e26d675c
SHA1

e74e6e950a8827f2baefe6c11d86923e06824a6b
SHA256

bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0
SHA512

eca005570f7f76d451467e8c4a7fdd8b25130e3895bc1f0bac75e6bbdcbb062d7c724058de870e672294ddd54e24a8de192abaa7c646eac549508c7700d35e72
SSDEEP

3072:qtlS53uSK5BRmOw+8p6yclYpKaFYYGBfWoq4:qzS5Y5COw+vyC7I4

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4832	BlueRaTech.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2608	4832	WerFault.exe	82

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4832	3876	bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe	82
PID 3876 wrote to memory of 4832	3876	bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe	82
PID 3876 wrote to memory of 4832	3876	bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe	82

C:\Users\Admin\AppData\Local\Temp\bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe
"C:\Users\Admin\AppData\Local\Temp\bcda430c964ec79cb7fbaafdf69b08fbd5dc2d7f0bd1a3a7bbda5ba9048e85f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\BlueRaTech.exe
  C:\Users\Admin\AppData\Local\Temp\BlueRaTech.exe
  2⤵
  - Executes dropped EXE
  PID:4832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 320
    3⤵
    - Program crash
    PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4832 -ip 4832
1⤵
PID:216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\BlueRaTech.exe

Filesize
75KB

MD5
04f3b4c6bc334efebe7e410175c4dc4f

SHA1
fbf2b0171b5edc5ef716861db1072a621693d859

SHA256
10112db58174c278bcced3740e3256f122dd2945d4903f0f85459edb21d79701

SHA512
58579824f202dd3aa63d5567f50f4a9ea5fb237cc6009285e8ecb1c32b09e7e25bbd5e903ff2b7f3176fe43c3298a147cd6aa6f97a1b45e130b6fba2a862c1eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\BlueRaTech.exe

Filesize
75KB

MD5
04f3b4c6bc334efebe7e410175c4dc4f

SHA1
fbf2b0171b5edc5ef716861db1072a621693d859

SHA256
10112db58174c278bcced3740e3256f122dd2945d4903f0f85459edb21d79701

SHA512
58579824f202dd3aa63d5567f50f4a9ea5fb237cc6009285e8ecb1c32b09e7e25bbd5e903ff2b7f3176fe43c3298a147cd6aa6f97a1b45e130b6fba2a862c1eb

Download Submit
memory/4832-135-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download
memory/4832-136-0x0000000000520000-0x0000000000537000-memory.dmp

Filesize
92KB

Download